# Best sandbox for OpenAI Codex CLI in 2026

OpenAI says to use `danger-full-access` only in an isolated runner; the best one is a throwaway microVM that never holds your key.

**On Runtime, `codex exec --sandbox danger-full-access` runs in a Firecracker
microVM with its own Linux kernel, so Codex gets the whole machine and your
servers stay out of reach.** The OpenAI key is a Runtime secret, which the
sandbox sees only as a placeholder, and the host's network rules hold Codex to
the hosts you allow. Two thousand fifteen-minute tasks a month, each busy for
two CPU-minutes, cost $16.67 on Runtime against
$82.80 on E2B and $118.98 on
Modal, at rates checked 23 September to 2 October 2026.

## Why does Codex need a sandbox around it?

Codex sandboxes itself with the operating system's own tools, and has three
modes, which [OpenAI's non-interactive guide](https://learn.chatgpt.com/docs/non-interactive-mode)
and sandboxing docs describe (read 1 October 2026):

| Codex mode           | What Codex may do                            | What OpenAI says                                                      |
| -------------------- | -------------------------------------------- | --------------------------------------------------------------------- |
| `read-only`          | Read files; edits and commands need approval | "By default, `codex exec` runs in a read-only sandbox"                |
| `workspace-write`    | Edit the workspace and run routine commands  | The mode to name instead of the deprecated `--full-auto`              |
| `danger-full-access` | Anything: no filesystem or network limits    | Use it "only in a controlled environment", such as an isolated runner |

The first two keep Codex on a short leash, which is right on a laptop and
slows down an agent meant to install packages, start services and run the
full test suite on its own. The third is what unattended work wants, and it
moves the boundary outward: the machine Codex runs on becomes the sandbox.

## What should the machine around Codex give it?

- **A kernel of its own.** A container shares the host's kernel; a microVM
  does not, so `danger-full-access` reaches only a machine made for the task.
- **No key to steal.** `codex exec` reads `CODEX_API_KEY`. Store it with
  `npx withruntime secrets set CODEX_API_KEY --host api.openai.com` and every
  sandbox has a placeholder; only requests to `api.openai.com` carry the value.
- **Egress rules outside its reach.** `sbx.network.set()` is enforced by the
  host, so a prompt-injected Codex cannot reopen what you closed.
- **State between tasks.** A paused sandbox keeps its checkout, its installed
  dependencies and its running database, so `codex exec resume --last` picks up
  in the same machine.
- **Many at once.** A paid account runs 100 sandboxes at a time,
  each on its own kernel.

## How much do Codex tasks cost on each sandbox?

Two thousand tasks a month on a 2 vCPU, 4 GiB machine, each fifteen minutes
long and busy for 120 CPU-seconds:

| Provider           | Isolation                 | CPU billed on     | A month of tasks                     |
| ------------------ | ------------------------- | ----------------- | ------------------------------------ |
| Runtime            | Firecracker microVM       | Measured use      | $16.67    |
| Cloudflare Sandbox | A container in its own VM | Measured use      | $33.31 |
| Vercel Sandbox     | Firecracker microVM       | Measured use      | $50.93     |
| E2B                | Firecracker microVM       | Every vCPU held   | $82.80        |
| Daytona            | Containers by default     | Every vCPU held   | $82.80    |
| Modal              | gVisor, a shared kernel   | The CPU requested | $118.98      |

Runtime is 80% cheaper than E2B for this month and
50% cheaper than Cloudflare. A Codex task is
mostly the model thinking; Runtime bills that time at its floor of
a twentieth of a vCPU per vCPU.

## A run on Runtime, recorded 1 October 2026

```ts check
import { Sandbox } from "withruntime";

await using sbx = await Sandbox.create({ timeoutSeconds: 3600 });
const slow = { check: true, timeoutMs: 600_000 } as const;
await sbx.exec("npm install -g @openai/codex", slow);
await sbx.exec(
  ["git", "clone", "--depth", "1", "https://github.com/your-org/your-repo", "/workspace/app"],
  slow,
);
await sbx.network.set({ internet: true, allow: ["api.openai.com", "registry.npmjs.org"] });
const run = await sbx.exec(
  [
    "codex",
    "exec",
    "--sandbox",
    "danger-full-access",
    "--json",
    "Fix the failing test, then run the suite.",
  ],
  { cwd: "/workspace/app", timeoutMs: 1_800_000 },
);
console.log(run.exitCode);
```

On 1 October 2026 the install and the version check ran in a fresh production
sandbox, with no model call:

```text
npm install -g @openai/codex   exit 0
codex --version                codex-cli 0.160.0
```

The flags that matter for automation, from `--output-schema` to
`codex exec resume`, are listed in [Codex in a sandbox](/integrations/codex).

## Can Codex call Runtime instead of running inside it?

Yes. With `codex mcp add runtime -- npx -y withruntime mcp`, Codex on your own
machine creates sandboxes, runs commands in them and reads results back,
keeping its own `workspace-write` boundary for local edits. Use that for a
developer's session, and Codex inside a sandbox for jobs nobody is watching.

## When might another sandbox fit better?

- **Codex cloud.** OpenAI's own cloud tasks run Codex from ChatGPT with
  environments OpenAI hosts. A sandbox you hold is for runs your own code
  starts, on your schedule, with your network rules.

## Sources

Checked 1 October 2026.

- [Codex non-interactive mode](https://learn.chatgpt.com/docs/non-interactive-mode):
  the read-only default and the guidance on `danger-full-access`
- [Codex sandboxing](https://learn.chatgpt.com/docs/sandboxing): the three
  sandbox modes
- Each provider's published rates, checked 23 September to 2 October 2026, as the
  [pricing guide](/docs/pricing) lists them
- The recorded run: `@openai/codex` 0.160.0 from npm, in a production sandbox
  on 1 October 2026