Which sandbox is best for Codex?
It depends on who starts Codex. For full-access runs your own code starts, Runtime gives each task a microVM with its own kernel that never holds the OpenAI key, and costs least of the sandboxes priced below: $16.67 for two thousand tasks, against $33.31 on Cloudflare Sandbox and $82.80 on E2B. A Codex task is mostly the model thinking, and Runtime bills measured CPU. Pick Codex cloud if you start tasks from ChatGPT and want OpenAI to host the environment.
Why does Codex need a sandbox around it?
Codex sandboxes itself with the operating system's own tools, and has three modes, which OpenAI's non-interactive guide and sandboxing docs describe (read 25 October 2026):
| Codex mode | What Codex may do | What OpenAI says |
|---|---|---|
read-only |
Read files; edits and commands need approval | "By default, codex exec runs in a read-only sandbox" |
workspace-write |
Edit the workspace and run routine commands | The mode to name now that --full-auto is no longer supported |
danger-full-access |
Anything: no filesystem or network limits | Use it "only in a controlled environment", such as an isolated runner |
The first two keep Codex on a short leash, which is right on a laptop and slows down an agent meant to install packages, start services and run the full test suite on its own. The third is what unattended work wants, and it moves the boundary outward: the machine Codex runs on becomes the sandbox.
What should the machine around Codex give it?
- A kernel of its own. A container shares the host's kernel; a microVM
does not, so
danger-full-accessreaches only a machine made for the task. - No key to steal.
codex execreadsCODEX_API_KEY. A sandbox that holds only a placeholder, with the value added on requests toapi.openai.com, has no key for Codex to leak. - Egress rules outside its reach. Rules the host enforces mean a prompt-injected Codex cannot reopen what you closed.
- State between tasks. A paused sandbox that keeps its checkout, its
installed dependencies and its running database lets
codex exec resume --lastpick up in the same machine. - Many in parallel. Enough sandboxes running at the same time, each with its own kernel, for the tasks you run in parallel.
How much do Codex tasks cost on each sandbox?
Two thousand tasks a month on a 2 vCPU, 4 GiB machine, each fifteen minutes long and busy for 120 CPU-seconds:
| Provider | Isolation | CPU billed on | A month of tasks |
|---|---|---|---|
| Runtime Cloud | Firecracker microVM | Measured use | $16.67 |
| Cloudflare Sandbox | A container in its own VM | Measured use | $33.31 |
| Vercel Sandbox | Firecracker microVM | Measured use | $50.93 |
| E2B | Firecracker microVM | Every vCPU held | $82.80 |
| Daytona | Containers by default | Every vCPU held | $82.80 |
| Modal | gVisor, a shared kernel | The CPU requested | $118.98 |
A Codex task is mostly the model thinking, so a meter that bills measured CPU charges little for that time.
When might another sandbox fit better?
- Codex cloud. OpenAI's own cloud tasks run Codex from ChatGPT with environments OpenAI hosts. A sandbox you hold is for runs your own code starts, on your schedule, with your network rules.
Runtime Cloud
On Runtime, codex exec --sandbox danger-full-access runs in a Firecracker
microVM with its own Linux kernel, so Codex gets the whole machine and your
servers stay out of reach. The OpenAI key is a Runtime secret: store it with
npx withruntime secrets set CODEX_API_KEY --host api.openai.com and every
sandbox has a placeholder; only requests to api.openai.com carry the value.
sbx.network.set() is enforced by the host, so the network rules hold Codex
to the hosts you allow. A paid account runs 100 sandboxes at a
time.
The two thousand tasks above cost $16.67 on Runtime, 80% less than E2B and 50% less than Cloudflare, at rates checked 25 October 2026. Runtime bills the model's thinking time at its floor of a twentieth of a vCPU per vCPU.
A run on Runtime, recorded 1 October 2026
TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ timeoutSeconds: 3600 });const slow = { check: true, timeoutMs: 600_000 } as const;await sbx.exec("npm install -g @openai/codex", slow);await sbx.exec( ["git", "clone", "--depth", "1", "https://github.com/your-org/your-repo", "/workspace/app"], slow,);await sbx.network.set({ internet: true, allow: ["api.openai.com", "registry.npmjs.org"] });const run = await sbx.exec( [ "codex", "exec", "--sandbox", "danger-full-access", "--json", "Fix the failing test, then run the suite.", ], { cwd: "/workspace/app", timeoutMs: 1_800_000 },);console.log(run.exitCode);On 1 October 2026 the install and the version check ran in a fresh production sandbox, with no model call:
textnpm install -g @openai/codex exit 0codex --version codex-cli 0.160.0The flags that matter for automation, from --output-schema to
codex exec resume, are listed in Codex in a sandbox.
Can Codex call Runtime instead of running inside it?
Yes. With codex mcp add runtime -- npx -y withruntime mcp, Codex on your own
machine creates sandboxes, runs commands in them and reads results back,
keeping its own workspace-write boundary for local edits. Use that for a
developer's session, and Codex inside a sandbox for jobs nobody is watching.
Start with free usage: npx withruntime login, then the code above. A Codex
runner already built on another sandbox moves with the
migration guide.
Sources
Checked 25 October 2026.
- Codex non-interactive mode:
the read-only default and the guidance on
danger-full-access - Codex sandboxing: the three sandbox modes
- Each provider's published rates, checked 25 October 2026, as the pricing guide lists them
- The recorded run:
@openai/codex0.160.0 from npm, in a production sandbox on 1 October 2026