# contained/agent-codex — OpenAI Codex CLI on top of the Contained base image.
# Built automatically on the first start of a sandbox that uses it (and
# rebuilt when these files change), or by hand:
#   docker build -t contained/agent-codex:latest build/agents/codex
FROM contained/agent-base:latest

# Root's install steps must not write into the agent's home (see HOME).
USER root
ENV HOME=/root
# bubblewrap: Codex checks for it at startup and warns when it is missing.
# It cannot actually sandbox anything inside a container (creating a
# namespace is not permitted), which is why the wrapper turns Codex's own
# command sandbox off — the Contained sandbox is the containment.
RUN apt-get update \
    && apt-get install -y --no-install-recommends bubblewrap \
    && rm -rf /var/lib/apt/lists/*
# Pinned like the base image; raise it here.
ARG CODEX_VERSION=0.156.1
RUN npm install -g @openai/codex@${CODEX_VERSION}
# Codex wants a login for its API key and must not sandbox its own
# commands here; see the file `codex` next to this Dockerfile.
COPY codex /opt/contained/bin/codex
RUN chmod 0755 /opt/contained/bin/codex
ENV PATH=/opt/contained/bin:$PATH
ENV HOME=/home/node
USER node
