Codex sandbox modes: read-only, workspace-write, danger-full-access and network access

• read-only: Codex can inspect files but cannot edit files or run commands without approval.
• workspace-write: Codex can read files, edit inside the workspace and run routine local commands there. This is the default low-friction mode for local work. Network access is off by default.
• danger-full-access: no sandbox. Filesystem and network limits are removed. OpenAI marks it as elevated risk and not recommended.

codex --sandbox workspace-write --ask-for-approval on-request

codex --sandbox read-only --ask-for-approval on-request

codex --sandbox read-only --ask-for-approval never

Inside a session you can switch to read-only with the /permissions command.

sandbox_mode accepts read-only, workspace-write or danger-full-access. Extra keys under [sandbox_workspace_write] apply only in workspace-write mode.

sandbox_mode = "workspace-write"
approval_policy = "on-request"

[sandbox_workspace_write]
network_access = true
writable_roots = ["/path/to/another/folder"]

• network_access: allow outbound network access inside the workspace-write sandbox.
• writable_roots: extra folders Codex may write to.
• exclude_tmpdir_env_var: remove $TMPDIR from writable roots.
• exclude_slash_tmp: remove /tmp from writable roots.

Even in workspace-write, some folders inside a writable root stay read-only, including everything under them:

• <writable_root>/.git, whether it is a folder or a file. If it is a gitdir pointer file, the real Git folder is protected too.
• <writable_root>/.agents when it exists as a folder.
• <writable_root>/.codex when it exists as a folder.

• macOS: the built-in Seatbelt framework. It works out of the box.
• Linux and WSL2: bubblewrap (bwrap). Codex uses the first bwrap on PATH and otherwise falls back to a bundled helper that needs unprivileged user namespace support.
• Windows: the native Windows sandbox in PowerShell, and the Linux sandbox in WSL2.