mirror of
https://github.com/openai/codex.git
synced 2026-04-24 14:45:27 +00:00
dbfe855f4f
## Description Keeps the existing Codex contributor devcontainer in place and adds a separate secure profile for customer use. ## What changed - leaves `.devcontainer/devcontainer.json` and the contributor `Dockerfile` aligned with `main` - adds `.devcontainer/devcontainer.secure.json` and `.devcontainer/Dockerfile.secure` - adds secure-profile bootstrap scripts: - `post_install.py` - `post-start.sh` - `init-firewall.sh` - updates `.devcontainer/README.md` to explain when to use each path ## Secure profile behavior The new secure profile is opt-in and is meant for running Codex in a stricter project container: - preinstalls the Codex CLI plus common build tools - uses persistent volumes for Codex state, Cargo, Rustup, and GitHub auth - applies an allowlist-driven outbound firewall at startup - blocks IPv6 by default so the allowlist cannot be bypassed via AAAA routes - keeps the stricter networking isolated from the default contributor workflow ## Resulting behavior - `devcontainer.json` remains the low-friction Codex contributor setup - `devcontainer.secure.json` is the customer-facing secure option - the repo supports both workflows without forcing the secure profile on Codex contributors
37 lines
1.1 KiB
Bash
37 lines
1.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [ "${CODEX_ENABLE_FIREWALL:-1}" != "1" ]; then
|
|
echo "[devcontainer] Firewall mode: permissive (CODEX_ENABLE_FIREWALL=${CODEX_ENABLE_FIREWALL:-unset})."
|
|
exit 0
|
|
fi
|
|
|
|
echo "[devcontainer] Firewall mode: strict"
|
|
|
|
domains_raw="${OPENAI_ALLOWED_DOMAINS:-api.openai.com}"
|
|
mapfile -t domains < <(printf '%s\n' "$domains_raw" | tr ', ' '\n\n' | sed '/^$/d' | sort -u)
|
|
|
|
if [ "${#domains[@]}" -eq 0 ]; then
|
|
echo "[devcontainer] No allowed domains configured."
|
|
exit 1
|
|
fi
|
|
|
|
tmp_file="$(mktemp)"
|
|
for domain in "${domains[@]}"; do
|
|
if [[ ! "$domain" =~ ^[a-zA-Z0-9][a-zA-Z0-9.-]*\.[a-zA-Z]{2,}$ ]]; then
|
|
echo "[devcontainer] Invalid domain in OPENAI_ALLOWED_DOMAINS: $domain"
|
|
rm -f "$tmp_file"
|
|
exit 1
|
|
fi
|
|
printf '%s\n' "$domain" >> "$tmp_file"
|
|
done
|
|
|
|
sudo install -d -m 0755 /etc/codex
|
|
sudo cp "$tmp_file" /etc/codex/allowed_domains.txt
|
|
sudo chown root:root /etc/codex/allowed_domains.txt
|
|
sudo chmod 0444 /etc/codex/allowed_domains.txt
|
|
rm -f "$tmp_file"
|
|
|
|
echo "[devcontainer] Applying firewall policy for domains: ${domains[*]}"
|
|
sudo --preserve-env=CODEX_INCLUDE_GITHUB_META_RANGES /usr/local/bin/init-firewall.sh
|