mirror of
https://github.com/openai/codex.git
synced 2026-05-03 12:52:11 +03:00
dbfe855f4f
## Description Keeps the existing Codex contributor devcontainer in place and adds a separate secure profile for customer use. ## What changed - leaves `.devcontainer/devcontainer.json` and the contributor `Dockerfile` aligned with `main` - adds `.devcontainer/devcontainer.secure.json` and `.devcontainer/Dockerfile.secure` - adds secure-profile bootstrap scripts: - `post_install.py` - `post-start.sh` - `init-firewall.sh` - updates `.devcontainer/README.md` to explain when to use each path ## Secure profile behavior The new secure profile is opt-in and is meant for running Codex in a stricter project container: - preinstalls the Codex CLI plus common build tools - uses persistent volumes for Codex state, Cargo, Rustup, and GitHub auth - applies an allowlist-driven outbound firewall at startup - blocks IPv6 by default so the allowlist cannot be bypassed via AAAA routes - keeps the stricter networking isolated from the default contributor workflow ## Resulting behavior - `devcontainer.json` remains the low-friction Codex contributor setup - `devcontainer.secure.json` is the customer-facing secure option - the repo supports both workflows without forcing the secure profile on Codex contributors
46 lines
2.2 KiB
Markdown
46 lines
2.2 KiB
Markdown
# Containerized Development
|
|
|
|
We provide two container paths:
|
|
|
|
- `devcontainer.json` keeps the existing Codex contributor setup for working on this repository.
|
|
- `devcontainer.secure.json` adds a customer-oriented profile with stricter outbound network controls.
|
|
|
|
## Codex contributor profile
|
|
|
|
Use `devcontainer.json` when you are developing Codex itself. This is the same lightweight arm64 container that already exists in the repo.
|
|
|
|
## Secure customer profile
|
|
|
|
Use `devcontainer.secure.json` when you want a stricter runtime profile for running Codex inside a project container:
|
|
|
|
- installs the Codex CLI plus common build tools
|
|
- enables firewall startup with an allowlist-driven outbound policy
|
|
- blocks IPv6 by default so the allowlist cannot be bypassed over AAAA routes
|
|
- requires `NET_ADMIN` and `NET_RAW` so the firewall can be installed at startup
|
|
|
|
This profile keeps the stricter networking isolated to the customer path instead of changing the default Codex contributor container.
|
|
|
|
Start it from the CLI with:
|
|
|
|
```bash
|
|
devcontainer up --workspace-folder . --config .devcontainer/devcontainer.secure.json
|
|
```
|
|
|
|
In VS Code, choose **Dev Containers: Open Folder in Container...** and select `.devcontainer/devcontainer.secure.json`.
|
|
|
|
## Docker
|
|
|
|
To build the contributor image locally for x64 and then run it with the repo mounted under `/workspace`:
|
|
|
|
```shell
|
|
CODEX_DOCKER_IMAGE_NAME=codex-linux-dev
|
|
docker build --platform=linux/amd64 -t "$CODEX_DOCKER_IMAGE_NAME" ./.devcontainer
|
|
docker run --platform=linux/amd64 --rm -it -e CARGO_TARGET_DIR=/workspace/codex-rs/target-amd64 -v "$PWD":/workspace -w /workspace/codex-rs "$CODEX_DOCKER_IMAGE_NAME"
|
|
```
|
|
|
|
Note that `/workspace/target` will contain the binaries built for your host platform, so we include `-e CARGO_TARGET_DIR=/workspace/codex-rs/target-amd64` in the `docker run` command so that the binaries built inside your container are written to a separate directory.
|
|
|
|
For arm64, specify `--platform=linux/arm64` instead for both `docker build` and `docker run`.
|
|
|
|
Currently, the contributor `Dockerfile` works for both x64 and arm64 Linux, though you need to run `rustup target add x86_64-unknown-linux-musl` yourself to install the musl toolchain for x64.
|