Run Codex CLI inside a Podman container with full network access and explicit filesystem allowlist mounts.
SaferSkills independently audited codex-container-sandbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this when you want:
codex (web search, fetching, etc.)This repo contains a wrapper script intended to be installed as codex-container-sandbox.
From the repo root (this repository):
podman build -t localhost/codex-container-sandbox:latest -f Containerfile . install -m 0755 codex-container-sandbox ~/.local/bin/codex-container-sandboxCreate ~/.config/codex-container-sandbox/config.sh:
CODEX_CONTAINER_SANDBOX_IMAGE="localhost/codex-container-sandbox:latest"
# Extra read-only mounts (mapped under /home/codex/... if under $HOME)
CODEX_CONTAINER_SANDBOX_RO_MOUNTS=(
"$HOME/.local/bin"
)
# Extra read-write mounts
CODEX_CONTAINER_SANDBOX_RW_MOUNTS=(
"$HOME/.cache/uv"
"$HOME/tmp"
) codex-container-sandbox --shell
codex login ./selftest.shIf this repo is vendored as a git submodule at ./codex-container-sandbox/ (for example in a dotfiles repo), either:
cd codex-container-sandbox && ./selftest.sh, or./codex-container-sandbox/selftest.sh from the parent repo root. codex-container-sandbox exec "Summarize this repo"--dangerously-bypass-approvals-and-sandbox) with full networking. Anything mounted into the container can be exfiltrated.$HOME unless you intend to expose them.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.