There's a `docker sandbox run codex` command, but it requires Docker Desktop to be installed, which is pretty undesirable on Linux since it replaces Docker Engine with a VM environment. This simple script does similar things.

docker-codex

#!/usr/bin/env bash

set -e

image='docker-codex'
docker_args=()

case "$1" in
  -h|--help)
    echo 'Usage: docker-codex [options] [command] [prompt]'
    echo 'docker-codex commands:'
    echo '  update [docker-build-flags]  Pull latest image and update packages'
    echo '  env FILE  Run codex with environment variables loaded from FILE'
    echo ''
    echo '  cat       Run the CMD in container'
    echo '  cp        ...'
    echo '  ls        ...'
    echo '  npm       ...'
    echo '  pnpm      ...'
    echo '  sh        ...'
    echo ''
    echo 'Original codex help:'
    echo ''
    set -- codex --help
    ;;
  update)
    shift
    docker build --pull "$@" -t "${image}" - <<EOF
FROM node:24
RUN usermod -l agent -d /home/agent -m node && groupmod -n agent node
RUN ln -sfn /home/agent /home/$(id -un)
RUN npm i -g @openai/codex pnpm
USER agent
WORKDIR /home/agent
EOF
    echo 'Codex was updated'
    set -- codex --version
    ;;
  cat|cp|ls|npm|pnpm|sh) ;;
  env)
    if [ -z "$2" ]; then
      echo 'docker-codex: env requires an ENV_PATH argument' >&2
      exit 1
    fi
    if [ ! -f "$2" ]; then
      echo "docker-codex: env file not found: $2" >&2
      exit 1
    fi
    docker_args+=(--env-file "$2")
    shift 2
    set -- codex --dangerously-bypass-approvals-and-sandbox "$@"
    ;;
  *) set -- codex --dangerously-bypass-approvals-and-sandbox "$@" ;;
esac

if ! docker image inspect "${image}" >/dev/null 2>&1; then
  "$0" update
fi

docker run --init -it --rm \
  "${docker_args[@]}" \
  -v "$(pwd):$(pwd)" -w "$(pwd)" \
  -v "${HOME}/.codex:/home/agent/.codex" \
  -v "${HOME}/.agents:/home/agent/.agents" \
  -v "${HOME}/.codex.json:/home/agent/.codex.json" \
  -v /run/user/$(id -u)/bus:/run/user/$(id -u)/bus \
  -e DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(id -u)/bus" \
  -e GIT_AUTHOR_NAME="$(git config user.name)" \
  -e GIT_AUTHOR_EMAIL="$(git config user.email)" \
  -e TERM=xterm-256color \
  -e COLORTERM=truecolor \
  "${image}" "$@"