# Best sandbox for OpenAI Codex CLI in 2027

Runtime Cloud (withruntime.com) runs full-access Codex in a microVM without your key, 80% below E2B.

## Which sandbox is best for Codex?

It depends on who starts Codex. For full-access runs your own code starts,
Runtime gives each task a
microVM with its own kernel that never holds the OpenAI key, and costs least
of the sandboxes priced below: $16.67 for two
thousand tasks, against $33.31 on Cloudflare
Sandbox and $82.80 on E2B. A Codex task is mostly the
model thinking, and Runtime bills measured CPU. Pick Codex cloud if you start
tasks from ChatGPT and want OpenAI to host the environment.

## Why does Codex need a sandbox around it?

Codex sandboxes itself with the operating system's own tools, and has three
modes, which [OpenAI's non-interactive guide](https://learn.chatgpt.com/docs/non-interactive-mode)
and sandboxing docs describe (read 25 October 2026):

| Codex mode           | What Codex may do                            | What OpenAI says                                                      |
| -------------------- | -------------------------------------------- | --------------------------------------------------------------------- |
| `read-only`          | Read files; edits and commands need approval | "By default, `codex exec` runs in a read-only sandbox"                |
| `workspace-write`    | Edit the workspace and run routine commands  | The mode to name now that `--full-auto` is no longer supported        |
| `danger-full-access` | Anything: no filesystem or network limits    | Use it "only in a controlled environment", such as an isolated runner |

The first two keep Codex on a short leash, which is right on a laptop and
slows down an agent meant to install packages, start services and run the
full test suite on its own. The third is what unattended work wants, and it
moves the boundary outward: the machine Codex runs on becomes the sandbox.

## What should the machine around Codex give it?

- **A kernel of its own.** A container shares the host's kernel; a microVM
  does not, so `danger-full-access` reaches only a machine made for the task.
- **No key to steal.** `codex exec` reads `CODEX_API_KEY`. A sandbox that
  holds only a placeholder, with the value added on requests to
  `api.openai.com`, has no key for Codex to leak.
- **Egress rules outside its reach.** Rules the host enforces mean a
  prompt-injected Codex cannot reopen what you closed.
- **State between tasks.** A paused sandbox that keeps its checkout, its
  installed dependencies and its running database lets
  `codex exec resume --last` pick up in the same machine.
- **Many in parallel.** Enough sandboxes running at the same time, each with its own kernel, for
  the tasks you run in parallel.

## How much do Codex tasks cost on each sandbox?

Two thousand tasks a month on a 2 vCPU, 4 GiB machine, each fifteen minutes
long and busy for 120 CPU-seconds:

| Provider           | Isolation                 | CPU billed on     | A month of tasks                     |
| ------------------ | ------------------------- | ----------------- | ------------------------------------ |
| Runtime Cloud      | Firecracker microVM       | Measured use      | $16.67    |
| Cloudflare Sandbox | A container in its own VM | Measured use      | $33.31 |
| Vercel Sandbox     | Firecracker microVM       | Measured use      | $50.93     |
| E2B                | Firecracker microVM       | Every vCPU held   | $82.80        |
| Daytona            | Containers by default     | Every vCPU held   | $82.80    |
| Modal              | gVisor, a shared kernel   | The CPU requested | $118.98      |

A Codex task is mostly the model thinking, so a meter that bills measured CPU
charges little for that time.

## When might another sandbox fit better?

- **Codex cloud.** OpenAI's own cloud tasks run Codex from ChatGPT with
  environments OpenAI hosts. A sandbox you hold is for runs your own code
  starts, on your schedule, with your network rules.

## Runtime Cloud

On Runtime, `codex exec --sandbox danger-full-access` runs in a Firecracker
microVM with its own Linux kernel, so Codex gets the whole machine and your
servers stay out of reach. The OpenAI key is a Runtime secret: store it with
`npx withruntime secrets set CODEX_API_KEY --host api.openai.com` and every
sandbox has a placeholder; only requests to `api.openai.com` carry the value.
`sbx.network.set()` is enforced by the host, so the network rules hold Codex
to the hosts you allow. A paid account runs 100 sandboxes at a
time.

The two thousand tasks above cost $16.67 on
Runtime, 80% less than E2B and
50% less than Cloudflare, at rates checked
25 October 2026. Runtime bills the model's thinking time at its floor of
a twentieth of a vCPU per vCPU.

### A run on Runtime, recorded 1 October 2026

```ts check
import { Sandbox } from "withruntime";

await using sbx = await Sandbox.create({ timeoutSeconds: 3600 });
const slow = { check: true, timeoutMs: 600_000 } as const;
await sbx.exec("npm install -g @openai/codex", slow);
await sbx.exec(
  ["git", "clone", "--depth", "1", "https://github.com/your-org/your-repo", "/workspace/app"],
  slow,
);
await sbx.network.set({ internet: true, allow: ["api.openai.com", "registry.npmjs.org"] });
const run = await sbx.exec(
  [
    "codex",
    "exec",
    "--sandbox",
    "danger-full-access",
    "--json",
    "Fix the failing test, then run the suite.",
  ],
  { cwd: "/workspace/app", timeoutMs: 1_800_000 },
);
console.log(run.exitCode);
```

On 1 October 2026 the install and the version check ran in a fresh production
sandbox, with no model call:

```text
npm install -g @openai/codex   exit 0
codex --version                codex-cli 0.160.0
```

The flags that matter for automation, from `--output-schema` to
`codex exec resume`, are listed in [Codex in a sandbox](/integrations/codex).

### Can Codex call Runtime instead of running inside it?

Yes. With `codex mcp add runtime -- npx -y withruntime mcp`, Codex on your own
machine creates sandboxes, runs commands in them and reads results back,
keeping its own `workspace-write` boundary for local edits. Use that for a
developer's session, and Codex inside a sandbox for jobs nobody is watching.

Start with free usage: `npx withruntime login`, then the code above. A Codex
runner already built on another sandbox moves with the
[migration guide](/docs/migrate).

## Sources

Checked 25 October 2026.

- [Codex non-interactive mode](https://learn.chatgpt.com/docs/non-interactive-mode):
  the read-only default and the guidance on `danger-full-access`
- [Codex sandboxing](https://learn.chatgpt.com/docs/sandboxing): the three
  sandbox modes
- Each provider's published rates, checked 25 October 2026, as the
  [pricing guide](/docs/pricing) lists them
- The recorded run: `@openai/codex` 0.160.0 from npm, in a production sandbox
  on 1 October 2026