docker/sbx-kit-codex-mixin:latest

schemaVersion: "3"
displayName: Codex CLI
author: Docker, Inc.
description: OpenAI's Codex CLI as a mixin — the native binary in an overlay, with the OpenAI credential (API key or ChatGPT OAuth) and the hooks the agent needs. Layer it onto a shell base and run `codex`.
sourceUrl: https://github.com/openai/codex
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.openai.com:443
                - openai.com:443
                - auth.openai.com:443
                - chatgpt.com:443
                - files.openai.com:443
                - registry.npmjs.org:443
                - releases.openai.com:443
                - api.github.com:443
                - github.com:443
                - release-assets.githubusercontent.com:443
                - codeload.github.com:443
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.openai.com
                  format: Bearer %s
                  header: Authorization
                - domain: openai.com
                  format: Bearer %s
                  header: Authorization
            name: OPENAI_API_KEY
            proxyManaged: true
        oauth:
            resourceHosts:
                - chatgpt.com
            sentinels:
                accessToken: oai-oat01-proxy-managed
                refreshToken: oai-ort01-proxy-managed
            tokenEndpoint:
                host: auth.openai.com
                path: /oauth/token
        phase: runtime
        service: openai
      description: OpenAI API access (API key or ChatGPT OAuth)
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                set -e
                mkdir -p /home/agent/.codex /home/agent/.agents
                MODE="${SBX_CRED_OPENAI_MODE:-none}"
                cat > /home/agent/.codex/config.toml << 'EOF'
                # Codex configuration for Docker sandbox
                # This configuration enables "yolo mode" - no approvals, full access

                approval_policy = "never"
                sandbox_mode = "danger-full-access"
                mcp_oauth_credentials_store = "file"
                EOF
                # Model selection from the create-phase args. These are
                # top-level keys, so they must land here, before the
                # model_providers and projects tables below would capture
                # them. The args' patterns admit no quote or backslash, so
                # the expanded value is safe inside the TOML string.
                model='${{ kit.args.model }}'
                effort='${{ kit.args.reasoningEffort }}'
                [ -z "$model" ] || printf 'model = "%s"\n' "$model" >> /home/agent/.codex/config.toml
                [ -z "$effort" ] || printf 'model_reasoning_effort = "%s"\n' "$effort" >> /home/agent/.codex/config.toml
                # Managed modes must not let remote clients replace the proxy
                # placeholder with sandbox-local ChatGPT OAuth. None mode
                # deliberately permits login.
                case "$MODE" in
                  oauth|apikey)
                    cat >> /home/agent/.codex/config.toml << 'EOF'
                forced_login_method = "api"
                EOF
                    ;;
                esac
                if [ "$MODE" = oauth ]; then
                  cat >> /home/agent/.codex/config.toml << 'EOF'

                model_provider = "sandboxd"

                [model_providers.sandboxd]
                name = "Sandbox Proxy"
                base_url = "https://chatgpt.com/backend-api/codex"
                experimental_bearer_token = "oai-oat01-proxy-managed"
                requires_openai_auth = false
                EOF
                fi
                # Pre-trust the workspace so codex skips its "do you trust this
                # directory" onboarding — the v2 kit skipped it via its
                # --dangerously-bypass-approvals-and-sandbox entrypoint, which a
                # mixin (plain `codex` from the base shell) doesn't have. MUST
                # stay after every top-level key append: [projects."…"] opens a
                # TOML table, and any key appended after it would silently land
                # inside that table (which is exactly how model_provider once
                # vanished, sending codex to api.openai.com with a ChatGPT
                # token and a scopes 401).
                ws="${WORKSPACE_DIR:-/home/agent/workspace}"
                esc=$(printf '%s' "$ws" | sed 's/\\/\\\\/g; s/"/\\"/g')
                cat >> /home/agent/.codex/config.toml <<EOF

                [projects."$esc"]
                trust_level = "trusted"
                EOF
                case "$MODE" in
                  oauth|apikey)
                    cat > /home/agent/.codex/auth.json << 'EOF'
                {
                  "OPENAI_API_KEY": "proxy-managed"
                }
                EOF
                    ;;
                  *)
                    rm -f /home/agent/.codex/auth.json
                    ;;
                esac
              description: Seed Codex config/auth from SBX_CRED_OPENAI_MODE
              env:
                - SBX_CRED_OPENAI_MODE
                - WORKSPACE_DIR
              user: agent
        startup:
            - command: |
                set -e
                [ -n "$MCP_GATEWAY_URL" ] || exit 0
                cfg="$HOME/.codex/config.toml"
                touch "$cfg"
                grep -q "^\[mcp_servers.mcp-gateway\]" "$cfg" && exit 0
                esc() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'; }
                url=$(esc "$MCP_GATEWAY_URL")
                auth=$(esc "$MCP_SENTINEL_TOKEN_NAME")
                # Codex's grammar for a streamable HTTP server: the transport
                # is implied by `url` (a `command` would make it stdio; there
                # is no `type` key), and static headers go in `http_headers`.
                # A `[...headers]` sub-table is not read, so the gateway
                # would be reached without its bearer token and codex would
                # warn about both keys at startup.
                cat >> "$cfg" <<EOF

                [mcp_servers.mcp-gateway]
                url = "$url"
                http_headers = { Authorization = "Bearer $auth" }
                EOF
              description: Register the sandbox MCP gateway in ~/.codex/config.toml
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
    - type: com.docker.sandbox/agent-skills@1
      optional: true
      config:
        path: /home/agent/.agents/skills
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/codex-mixin/codex-context.md
args:
    model:
        default: ""
        description: Codex model to use (config.toml `model`); empty keeps the CLI default
        pattern: ^[A-Za-z0-9._-]*$
        env: CODEX_MODEL
    reasoningEffort:
        default: ""
        description: Reasoning effort (config.toml `model_reasoning_effort`); empty keeps the CLI default
        pattern: ^(none|minimal|low|medium|high|xhigh|max|ultra|persistent)?$
        env: CODEX_REASONING_EFFORT
    version:
        default: 0.159.2
        description: Codex CLI release to install
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: CODEX_VERSION