skip to content

#sandbox (2)

Cheat sheets (2)

Approvals & Sandboxing

Control what Codex CLI can do — approval policies (untrusted, on-request, never), sandbox modes (read-only, workspace-write, danger-full-access), OS-native sandbox mechanics, and --full-auto.
codex openai sandbox approvals security seatbelt bwrap seccomp permissions

Security Fundamentals — Users, Permissions, Capabilities, MAC, Sandboxing

OS-level security primitives every operator should know: users and groups, file permissions, Linux capabilities, SUID/SGID, mandatory access control (SELinux, AppArmor), sandboxing concepts, least privilege, and encryption at rest vs in transit.
security users groups permissions capabilities suid sgid selinux apparmor sandbox encryption mac sysadmin