Your Coding Agent Should be in Jail. Here’s Why and How.

The more useful coding agents become, the more access they tend to need. Installing dependencies, running commands, changing files, and generally more autonomy are part of the appeal. They’re also the point where I start thinking about what else the coding agent can reach, especially while these tools are changing so quickly.

My answer is to give Codex its own jail: a devbox running as an Ubuntu virtual machine on Proxmox, with a separate Linux account for the agent. Think of it as a cell which gives the agent enough tools to do what it needs, but not break out.

The devbox runs headless, so there’s no graphical desktop to manage. I handle administrator tasks through my own account, while Codex gets room to work on its projects.

Why use a devbox?

Keeping personal files outside the devbox and development dependencies off my personal computer makes this setup useful day to day. If Codex makes a mistake or follows malicious instructions in a file, the devbox helps limit what it can affect. I can give it more freedom within its project while keeping administrator access separate.

There’s some upkeep involved: another machine needs memory, disk space, and updates, and I still handle tasks that require administrator access. For smaller jobs, Codex’s built-in sandbox may already be enough. It restricts which files and network connections commands can use.

A devbox also isn’t a magic undo button for a bad push to GitHub or a stolen credential. It can still reach whatever its network access and credentials allow. Keep unnecessary credentials out, and limit where it can connect. Your new inmate doesn’t need keys to the rest of the building.

Before you start

My Codex devbox uses Ubuntu Server 26.04.1 LTS in Proxmox, with Codex 0.153.4. This guide starts with Ubuntu already installed on the devbox.

Make sure that you have:

• An Ubuntu devbox with OpenSSH enabled.
• Your own Linux account with sudo access on that devbox.
• Basic SSH knowledge.

In the commands, replace your-user with your Linux username. Replace testbed.local with your devbox’s hostname or IP address. The codex username stays the same.

Your own account does the administrator tasks. The codex account runs the agent. Each step identifies the account and computer to use.

Step 1: Create the Codex account

On your computer, connect to the devbox with your own account:

ssh [email protected]

In that devbox session, install the required tools:

sudo apt-get update
sudo apt-get install -y curl ca-certificates git bubblewrap

Codex uses bubblewrap for its Linux sandbox.

Create the separate account:

sudo adduser --disabled-password --gecos '' codex

Display the account permissions:

id codex
sudo -l -U codex

My devbox returned this output:

uid=1001(codex) gid=1001(codex) groups=1001(codex),100(users)
User codex is not allowed to run sudo on testbed.

The account cannot log in with a password. It also cannot use sudo to get administrator permissions. Step 3 adds an SSH key for access.

From your own account, do a test of access to your home directory:

sudo -u codex test -x "$HOME"
echo $?

The result must be 1. This means the codex account cannot enter that directory. If the result is 0, restrict the directory permissions:

chmod 750 "$HOME"

Keep codex out of your account’s group. Do the access test again. Ubuntu’s user-management guide explains these permissions.

Step 2: Install Codex

In the devbox session, switch to the codex account:

sudo -iu codex

Run the official installer from this account:

mkdir -p ~/.local/bin ~/projects
curl -fsSL https://chatgpt.com/codex/install.sh -o ~/codex-install.sh
sh ~/codex-install.sh

If the installer asks to start Codex, select No. Add the install directory to this session’s command path:

export PATH="$HOME/.local/bin:$PATH"
codex --version

My devbox returned:

codex-cli 0.153.4

Start the ChatGPT login:

codex login --device-auth

Open the displayed link in your computer’s browser. Log in to your ChatGPT account. Enter the displayed code.

Your account or workspace can require you to enable device-code login first. OpenAI’s authentication guide also gives an SSH tunnel method.

Display the login status:

codex login status

My successful login returned:

Logged in using ChatGPT

Do not include login codes or stored authentication tokens in shared logs.

Return to your own Linux account:

exit

Keep this devbox session open for Step 3.

Step 3: Add your SSH key

Open a second terminal on your computer. Create a separate SSH key:

ssh-keygen -t ed25519 -f ~/.ssh/codex_devbox

Set a passphrase when prompted. Keep the private key on your computer. Copy only the public key to your own account on the devbox:

scp ~/.ssh/codex_devbox.pub [email protected]:~/codex_devbox.pub

In the first terminal, use your own account on the devbox. Use these commands only if the new account has no authorized_keys file. For an existing file, add the public key to the file. Do not replace the existing keys.

sudo install -d -m 700 -o codex -g codex /home/codex/.ssh
sudo install -m 600 -o codex -g codex \
  ~/codex_devbox.pub /home/codex/.ssh/authorized_keys

On your computer, add this entry to ~/.ssh/config:

Host codex-devbox
    HostName testbed.local
    User codex
    IdentityFile ~/.ssh/codex_devbox
    IdentitiesOnly yes
    ForwardAgent no

Do a connection test from your computer:

ssh codex-devbox 'bash -lc "whoami; command -v codex; codex --version"'

My SSH connection returned:

codex
/home/codex/.local/bin/codex
codex-cli 0.153.4

If the hostname does not resolve, use the devbox’s IP address. If Codex is missing, make sure its directory is in the remote login shell’s PATH.

Step 4: Run a small task

On your computer, connect with the new account:

ssh codex-devbox

In this devbox session, create a test project:

mkdir -p ~/projects/codex-smoke-test
cd ~/projects/codex-smoke-test
codex

Give Codex this request:

Create VM_CHECK.txt with this text:
Codex is running as the codex user inside testbed.
Run whoami.
Run hostname.
Display VM_CHECK.txt.

The earlier devbox test returned:

whoami: codex
hostname: testbed
cat VM_CHECK.txt: Codex is running as the codex user inside testbed.

Use the normal project permissions first. Use /permissions to change them when necessary. Full access can affect everything available to the codex account. It does not give the account sudo access.

Step 5: Connect the desktop and phone apps

Next up, for further convenience, we’ll connect the Codex desktop app on our personal computer and phone to the devbox instance. This will allow us to easily prompt the agent and see what it’s up to. If you only plan to interact with Codex via SSH, skip to the next section.

On your computer, open the ChatGPT desktop app:

1. Open Settings → Connections → SSH.
2. Add or enable codex-devbox.
3. Select the remote project folder, such as /home/codex/projects/codex-smoke-test.

The app runs project commands on the devbox. If the app cannot unlock your SSH key, load it into your computer’s SSH agent.

For phone access, use a compatible Mac or Windows computer with the desktop app:

1. Open Settings → Connections → Control this Mac or PC.
2. Start remote setup.
3. Scan the displayed QR code with your phone.
4. Complete the setup in ChatGPT on iOS or Android with the same account and workspace.
5. Open Remote on your phone.

The phone connects through the desktop app. That app connects to the Ubuntu devbox. The CLI alone cannot provide this phone connection. Feature availability depends on the app release and workspace policy.

Keep the desktop host, Proxmox host, and devbox awake and online. A separate desktop host lets you close your laptop while remote access stays available. If the laptop is the desktop host, it must stay available too.

Connect from another network

For SSH access outside your LAN, you can install something such as Tailscale on the devbox and your computer. Connect both devices to the same tailnet, which is your private Tailscale network. Replace HostName in your SSH configuration with the devbox’s Tailscale IP address or DNS name.

SSH still uses the key for the Linux login. Do not expose the Codex app-server port to the public internet.

Add stronger security controls

• Separate the network. Put the devbox on a dedicated VLAN. Use firewall rules outside the devbox to restrict access to your devices and Proxmox administration. Remove unnecessary access from Tailscale grants.
• Limit GitHub access. Use a deploy key for each repository that Codex must access. Deploy keys allow read access by default. Enable write access only when necessary. Separate credentials with limited permissions are necessary for API tasks, such as pull request creation.
• Keep administrator access separate. Install updates on Ubuntu and Proxmox. Do not share unnecessary host directories with the devbox. Keep administrator credentials outside it. Do not add codex to the normal Docker group, which gives root-level permissions.

A snapshot of the devbox can help you restore local files and settings. The available snapshot features depend on your Proxmox storage configuration.

Docker Sandboxes is another option that uses microVMs for agents. I did not use it for this guide. Make sure that its settings permit only the necessary host access. An ordinary Docker image does not provide the same isolation.

Keep the keys

This setup gives Codex project files, development tools, and the necessary access for its work. You do the administrator tasks. You can rebuild the devbox if an experiment fails.

The agent gets a useful workspace and the master keys stay with you. That is the kind of jail I can recommend.