Codex CLI

This example installs a pinned Codex CLI release inside a Node.js microVM and opens it in a project mounted from your host. Codex can work directly in the checkout, while its executable, authentication, configuration, and sessions stay inside the sandbox.

Run Codex CLI

Start Codex

Replace ./my-project with the project directory you want Codex to work on:

msb run -t --name codex-demo --replace \
  --cpus 2 --memory 2G --root-disk 4G \
  --mount-dir ./my-project:/workspace:rw \
  --workdir /workspace \
  node:24-bookworm-slim -- sh -lc '
    apt-get update &&
    apt-get install -y --no-install-recommends ca-certificates git &&
    npm install -g @openai/codex@0.148.0 &&
    exec codex
  '

msb run -t --name codex-demo --replace `
  --cpus 2 --memory 2G --root-disk 4G `
  --mount-dir ./my-project:/workspace:rw `
  --workdir /workspace `
  node:24-bookworm-slim -- sh -lc '
    apt-get update &&
    apt-get install -y --no-install-recommends ca-certificates git &&
    npm install -g @openai/codex@0.148.0 &&
    exec codex
  '

On first launch, choose Sign in with ChatGPT, Sign in with Device Code, or provide an API key. Browser-based sign-in happens on your host while the resulting Codex credentials are stored on the sandbox’s root disk.

For an isolated workspace, or when using microsandbox cloud, replace --mount-dir ./my-project:/workspace:rw with --copy-dir ./my-project:/workspace.

Start another session

After leaving Codex, return to the same sandbox and workspace with:

msb exec -t codex-demo -- codex

The sandbox root disk retains the files under /root/.codex, including authentication, configuration, and session history.

Verify the installation

Exit the TUI and run:

msb exec codex-demo -- codex --version

The pinned example prints codex-cli 0.148.0.

Review or export changes

With the default writable mount, changes are already in the host checkout. Review them inside the sandbox:

msb exec codex-demo -- sh -lc 'cd /workspace && git status --short && git diff --stat && git diff'

If you chose the isolated --copy-dir alternative, create a patch inside the sandbox:

msb exec codex-demo -- sh -lc 'cd /workspace && git add -N . && git diff --binary > /tmp/codex.patch'

Copy the patch to the host:

msb cp codex-demo:/tmp/codex.patch ./codex.patch

Check that it applies cleanly before applying it:

git apply --check ./codex.patch

Clean up

Remove the sandbox:

msb rm -f codex-demo

Removing the sandbox also removes its Codex credentials, configuration, and sessions. Changes made through the default workspace mount remain in the host checkout.

Agents

CI/CD

Docker

Sandbox Workflows

Automation & Tooling

Data & Observability

Run Codex CLI

Reference

​Run Codex CLI

​Reference

Run Codex CLI

Reference