Skip to content

codex entrypoint: pin -C workspace + bypass sandbox/approvals #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nprodromou merged 1 commit into from
May 8, 2026
Merged

codex entrypoint: pin -C workspace + bypass sandbox/approvals #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions bin/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,9 +71,13 @@ codex)
AGENT_AUTH_FILE="${AGENT_CONFIG_DIR}/auth.json"
# Codex looks for AGENTS.md as the global instructions file.
INSTRUCTIONS_LINK="${AGENT_CONFIG_DIR}/AGENTS.md"
# Resume the last session; fall back to a fresh codex if there is
# none, then drop to bash if codex exits.
AGENT_LAUNCH_CMD='codex resume --last 2>/dev/null || codex; exec bash -l'
# Resume the last session, pinned to the persistent workspace dir,
# with codex's internal sandbox + approvals bypassed (the apk8s pod
# boundary is the real security boundary; the inner bwrap sandbox
# fails on hardened k8s and just produces approval-prompt noise).
# Fall back to a fresh codex if no last session, then drop to bash
# if codex exits.
AGENT_LAUNCH_CMD='codex resume --last -C "$HOME/workspace" --dangerously-bypass-approvals-and-sandbox 2>/dev/null || codex -C "$HOME/workspace" --dangerously-bypass-approvals-and-sandbox; exec bash -l'

mkdir -p "${AGENT_CONFIG_DIR}"

Expand Down
Loading