Best sandbox for OpenAI Codex CLI in 2026

Q: What should the machine around Codex give it?

A kernel of its own. A container shares the host's kernel; a microVM does not, so danger-full-access reaches only a machine made for the task. No key to steal. codex exec reads CODEX_API_KEY. Store it with npx withruntime secrets set CODEX_API_KEY --host api.openai.com and every sandbox has a placeholder; only requests to api.openai.com carry the value. Egress rules outside its reach. sbx.network.set() is enforced by the host, so a prompt-injected Codex cannot reopen what you closed. State between tasks. A paused sandbox keeps its checkout, its installed dependencies and its running database, so codex exec resume --last picks up in the same machine. Many at once. A paid account runs 100 sandboxes at a time, each on its own kernel.

Q: Can Codex call Runtime instead of running inside it?

Yes. With codex mcp add runtime -- npx -y withruntime mcp, Codex on your own machine creates sandboxes, runs commands in them and reads results back, keeping its own workspace-write boundary for local edits. Use that for a developer's session, and Codex inside a sandbox for jobs nobody is watching.

Q: When might another sandbox fit better?

Codex cloud. OpenAI's own cloud tasks run Codex from ChatGPT with environments OpenAI hosts. A sandbox you hold is for runs your own code starts, on your schedule, with your network rules.

OpenAI says to use danger-full-access only in an isolated runner; the best one is a throwaway microVM that never holds your key.

On Runtime, codex exec --sandbox danger-full-access runs in a Firecracker microVM with its own Linux kernel, so Codex gets the whole machine and your servers stay out of reach. The OpenAI key is a Runtime secret, which the sandbox sees only as a placeholder, and the host's network rules hold Codex to the hosts you allow. Two thousand fifteen-minute tasks a month, each busy for two CPU-minutes, cost $16.67 on Runtime against $82.80 on E2B and $118.98 on Modal, at rates checked 23 September to 2 October 2026.

Why does Codex need a sandbox around it?

Codex sandboxes itself with the operating system's own tools, and has three modes, which OpenAI's non-interactive guide and sandboxing docs describe (read 1 October 2026):

Codex mode	What Codex may do	What OpenAI says
`read-only`	Read files; edits and commands need approval	"By default, `codex exec` runs in a read-only sandbox"
`workspace-write`	Edit the workspace and run routine commands	The mode to name instead of the deprecated `--full-auto`
`danger-full-access`	Anything: no filesystem or network limits	Use it "only in a controlled environment", such as an isolated runner

The first two keep Codex on a short leash, which is right on a laptop and slows down an agent meant to install packages, start services and run the full test suite on its own. The third is what unattended work wants, and it moves the boundary outward: the machine Codex runs on becomes the sandbox.

What should the machine around Codex give it?

A kernel of its own. A container shares the host's kernel; a microVM does not, so danger-full-access reaches only a machine made for the task.
No key to steal. codex exec reads CODEX_API_KEY. Store it with npx withruntime secrets set CODEX_API_KEY --host api.openai.com and every sandbox has a placeholder; only requests to api.openai.com carry the value.
Egress rules outside its reach. sbx.network.set() is enforced by the host, so a prompt-injected Codex cannot reopen what you closed.
State between tasks. A paused sandbox keeps its checkout, its installed dependencies and its running database, so codex exec resume --last picks up in the same machine.
Many at once. A paid account runs 100 sandboxes at a time, each on its own kernel.

How much do Codex tasks cost on each sandbox?

Two thousand tasks a month on a 2 vCPU, 4 GiB machine, each fifteen minutes long and busy for 120 CPU-seconds:

Provider	Isolation	CPU billed on	A month of tasks
Runtime	Firecracker microVM	Measured use	$16.67
Cloudflare Sandbox	A container in its own VM	Measured use	$33.31
Vercel Sandbox	Firecracker microVM	Measured use	$50.93
E2B	Firecracker microVM	Every vCPU held	$82.80
Daytona	Containers by default	Every vCPU held	$82.80
Modal	gVisor, a shared kernel	The CPU requested	$118.98

Runtime is 80% cheaper than E2B for this month and 50% cheaper than Cloudflare. A Codex task is mostly the model thinking; Runtime bills that time at its floor of a twentieth of a vCPU per vCPU.

A run on Runtime, recorded 1 October 2026

TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ timeoutSeconds: 3600 });const slow = { check: true, timeoutMs: 600_000 } as const;await sbx.exec("npm install -g @openai/codex", slow);await sbx.exec(  ["git", "clone", "--depth", "1", "https://github.com/your-org/your-repo", "/workspace/app"],  slow,);await sbx.network.set({ internet: true, allow: ["api.openai.com", "registry.npmjs.org"] });const run = await sbx.exec(  [    "codex",    "exec",    "--sandbox",    "danger-full-access",    "--json",    "Fix the failing test, then run the suite.",  ],  { cwd: "/workspace/app", timeoutMs: 1_800_000 },);console.log(run.exitCode);

On 1 October 2026 the install and the version check ran in a fresh production sandbox, with no model call:

textnpm install -g @openai/codex   exit 0codex --version                codex-cli 0.160.0

The flags that matter for automation, from --output-schema to codex exec resume, are listed in Codex in a sandbox.

Can Codex call Runtime instead of running inside it?

Yes. With codex mcp add runtime -- npx -y withruntime mcp, Codex on your own machine creates sandboxes, runs commands in them and reads results back, keeping its own workspace-write boundary for local edits. Use that for a developer's session, and Codex inside a sandbox for jobs nobody is watching.

When might another sandbox fit better?

Codex cloud. OpenAI's own cloud tasks run Codex from ChatGPT with environments OpenAI hosts. A sandbox you hold is for runs your own code starts, on your schedule, with your network rules.

Sources

Checked 1 October 2026.

Codex non-interactive mode: the read-only default and the guidance on danger-full-access
Codex sandboxing: the three sandbox modes
Each provider's published rates, checked 23 September to 2 October 2026, as the pricing guide lists them
The recorded run: @openai/codex 0.160.0 from npm, in a production sandbox on 1 October 2026