Use case · Codex CLI · Updated 2026-10-31

Give Codex full access, but only inside one machine.

A Codex CLI sandbox puts a boundary around the whole agent, not only the commands it runs. kosa8's built-in codex kit runs OpenAI's Codex CLI in its own microVM on your Mac or Linux machine: it sees one project folder, its network is closed except through a broker on your side, and it holds a placeholder instead of your OpenAI API key. Start it with kosa8 agent run codex.

01What does Codex's own sandbox cover?

Codex CLI has three sandbox modes: read-only, workspace-write and danger-full-access. OpenAI's docs say workspace-write keeps network access off unless you enable it, and that Codex enforces the sandbox with Seatbelt (sandbox-exec) on macOS and bubblewrap plus seccomp on Linux. The --dangerously-bypass-approvals-and-sandbox flag, alias --yolo, runs with no sandbox and no approvals, and the docs mark it not recommended.

Those limits are enforced by your own kernel, on the machine that holds your files and keys. OpenAI's docs also say that inside a Dev Container that is your intended security boundary, you can run Codex with --sandbox danger-full-access. A microVM can be that outer boundary.

02The built-in codex kit

kosa8 agent run codex starts a microVM from node:22-alpine with 4 vCPUs and 4096 MiB, installs @openai/codex pinned to version 0.162.1 and checked against its SHA-512 digest, mounts your current folder at /work and runs codex there. The sandbox is removed when Codex exits.

Arguments after the kit name go to Codex: kosa8 agent run codex --sandbox danger-full-access.

03The OpenAI key stays on your side

The sandbox gets OPENAI_API_KEY set to a placeholder and OPENAI_BASE_URL pointed at an egress broker on your computer, which adds the real key only to requests for api.openai.com. Apart from the broker, the kit allows registry.npmjs.org and nothing else. kosa8 agent kits shows the codex kit's keys as brokered.

04A record of every request

Every request Codex makes through the broker, allowed or refused, is written to kosa8's hash-chained audit log. kosa8's pre-run tool-call hook is wired for Claude Code only, so with Codex keep its own approval policy on for the calls you want to see first.

terminal

kosa8 audit ls
kosa8 audit verify

05Pause, checkpoint and fork

Freeze every running agent mid-step, with memory and files intact, or save the machine before a risky step and fork it to try approaches side by side. A checkpoint does not roll back the shared project folder; keep git for that.

terminal

kosa8 sandbox pause --all
kosa8 checkpoint NAME --label "before upgrade"
kosa8 fork NAME -n 3 --prefix try

06How to start

Install kosa8 and start its daemon.
Set your key on your computer, check the plan, and run Codex in your project.
terminal
```
export OPENAI_API_KEY=sk-...
kosa8 agent run --dry-run codex
kosa8 agent run codex
```

07Questions

Should I keep Codex's own sandbox on inside kosa8?

You can. OpenAI's docs say that when a Dev Container is your intended security boundary you can run Codex with --sandbox danger-full-access; a kosa8 microVM can play that role. Keeping Codex's approval policy on still makes it ask before the actions you care about.

Does the codex kit hold my OpenAI API key?

No. The sandbox holds a placeholder, and a broker on your computer adds the real key only to requests for api.openai.com. The built-in kit brokers OPENAI_API_KEY; other ways of signing in to Codex are not covered by the kit.

Which version of Codex does the kit install?

@openai/codex 0.162.1, checked against its SHA-512 digest before it is installed. Run kosa8 agent init codex to write an editable copy to ~/.kosa8/kits if you need another version.

Which machines can run it?

kosa8 runs its microVMs on an Apple silicon Mac (Apple's Virtualization framework) or on x86-64 Linux (KVM). On an Intel Mac it installs as the command-line tool only and drives sandboxes on one of those machines.

08Guides and articles

09Sources

10Try it on your own machine

Install kosa8 and give Codex a machine of its own, with your OpenAI key kept outside it.

Download kosa8 See plans

Updated 2026-10-31