dbfe855f4f
## Description Keeps the existing Codex contributor devcontainer in place and adds a separate secure profile for customer use. ## What changed - leaves `.devcontainer/devcontainer.json` and the contributor `Dockerfile` aligned with `main` - adds `.devcontainer/devcontainer.secure.json` and `.devcontainer/Dockerfile.secure` - adds secure-profile bootstrap scripts: - `post_install.py` - `post-start.sh` - `init-firewall.sh` - updates `.devcontainer/README.md` to explain when to use each path ## Secure profile behavior The new secure profile is opt-in and is meant for running Codex in a stricter project container: - preinstalls the Codex CLI plus common build tools - uses persistent volumes for Codex state, Cargo, Rustup, and GitHub auth - applies an allowlist-driven outbound firewall at startup - blocks IPv6 by default so the allowlist cannot be bypassed via AAAA routes - keeps the stricter networking isolated from the default contributor workflow ## Resulting behavior - `devcontainer.json` remains the low-friction Codex contributor setup - `devcontainer.secure.json` is the customer-facing secure option - the repo supports both workflows without forcing the secure profile on Codex contributors
2.2 KiB
Containerized Development
We provide two container paths:
devcontainer.jsonkeeps the existing Codex contributor setup for working on this repository.devcontainer.secure.jsonadds a customer-oriented profile with stricter outbound network controls.
Codex contributor profile
Use devcontainer.json when you are developing Codex itself. This is the same lightweight arm64 container that already exists in the repo.
Secure customer profile
Use devcontainer.secure.json when you want a stricter runtime profile for running Codex inside a project container:
- installs the Codex CLI plus common build tools
- enables firewall startup with an allowlist-driven outbound policy
- blocks IPv6 by default so the allowlist cannot be bypassed over AAAA routes
- requires
NET_ADMINandNET_RAWso the firewall can be installed at startup
This profile keeps the stricter networking isolated to the customer path instead of changing the default Codex contributor container.
Start it from the CLI with:
devcontainer up --workspace-folder . --config .devcontainer/devcontainer.secure.json
In VS Code, choose Dev Containers: Open Folder in Container... and select .devcontainer/devcontainer.secure.json.
Docker
To build the contributor image locally for x64 and then run it with the repo mounted under /workspace:
CODEX_DOCKER_IMAGE_NAME=codex-linux-dev
docker build --platform=linux/amd64 -t "$CODEX_DOCKER_IMAGE_NAME" ./.devcontainer
docker run --platform=linux/amd64 --rm -it -e CARGO_TARGET_DIR=/workspace/codex-rs/target-amd64 -v "$PWD":/workspace -w /workspace/codex-rs "$CODEX_DOCKER_IMAGE_NAME"
Note that /workspace/target will contain the binaries built for your host platform, so we include -e CARGO_TARGET_DIR=/workspace/codex-rs/target-amd64 in the docker run command so that the binaries built inside your container are written to a separate directory.
For arm64, specify --platform=linux/arm64 instead for both docker build and docker run.
Currently, the contributor Dockerfile works for both x64 and arm64 Linux, though you need to run rustup target add x86_64-unknown-linux-musl yourself to install the musl toolchain for x64.