brig docs

Guides

Run Codex with --yolo in a microVM

On this page

Codex's --yolo flag runs with no sandbox and no approvals. OpenAI says to use it only inside an externally hardened environment. Brig runs Codex in a microVM on Mac or Linux.

brig run codex ~/code/demo -- --yolo

Brig sends every argument after -- to Codex unchanged. The agent works in ~/code/demo, and the rest of your machine is out of its reach.

The Brig project wrote this page. OpenAI has not reviewed or endorsed it.

What the flag does #

--yolo is the alias of --dangerously-bypass-approvals-and-sandbox. OpenAI's documentation describes it as "No sandbox; no approvals" and marks it "not recommended". Codex then reads files, edits them and runs commands with network access, and it does not stop to ask.

Codex's command-line reference has no --dangerously-skip-permissions flag. That flag belongs to Claude Code, and Skip permissions covers it.

OpenAI lists these modes, from the most checks to none:

Mode Flags What Codex can do
Read-only --sandbox read-only --ask-for-approval on-request Read files and run commands inside a read-only sandbox
Auto, the default --sandbox workspace-write --ask-for-approval on-request Read, edit and run commands in the workspace. It asks before it edits outside the workspace or reaches the network
Full access --dangerously-bypass-approvals-and-sandbox, or --yolo Everything, with no sandbox and no approvals

Why a microVM #

With full access, Codex's own sandbox is off and nothing stops a command before it runs. OpenAI's reference says: "Only use inside an externally hardened environment."

Under Brig, Codex runs inside a machine of its own:

  • Its own kernel. Each sandbox is a microVM with its own Linux kernel, behind a hardware boundary.
  • One project. Brig mounts the project you name, read-write at /work/<name>, and a guest home for the agent's settings. Nothing else from your machine is mounted. Your keychain and your SSH agent stay out of reach.
  • The network you allow. An egress policy limits the sandbox to the hosts and ranges you name. Brig enforces it outside the guest, at a gateway on macOS and in nftables on Linux.
  • A clean start. brig rm removes the sandbox. Your project stays where it is.

Security model states each boundary and its limits.

Run Codex with the flag #

Codex is one of Brig's nine built-in profiles. Its image is a signed build for arm64 and x86-64, so brig run codex runs on a Mac with Apple silicon and on Linux. Agent profiles lists the profiles, and Install lists the hosts.

Install Brig and check the host. A !! line prints its fix beside it. See Install.

brig doctor

To limit the network, create a policy that names the hosts Codex needs, and attach it to the agent before the run. See Networking.

Then start Codex with the flag:

mkdir -p ~/code/demo
brig run codex ~/code/demo -- --yolo

Sign in once inside the guest with codex login --device-auth. The login lands in the guest home, which Brig keeps on host disk, so it survives brig stop. Brig refuses OPENAI_API_KEY from your environment, because a forwarded key moves the sandbox off your subscription and onto metered billing. Authentication covers both.

Codex's own sandbox inside Brig #

Codex wraps each command in a sandbox of its own, with bubblewrap on Linux. OpenAI's documentation gives two choices inside a container:

  • Keep Codex's sandbox on, if the container lets bubblewrap create the inner sandbox.
  • If the container is your security boundary, run Codex with --sandbox danger-full-access, "so Codex does not try to create a second sandbox layer".

Agent sandboxes says an agent can run its own sandbox inside a Brig guest. To make the microVM the only boundary, pass the sandbox mode alone:

brig run codex ~/code/demo -- --sandbox danger-full-access

What it can still reach #

Without a sandbox or approvals, the agent still has everything you gave the sandbox:

  • The agent edits the real files in the project, so its work lands in your project.
  • The agent can send what it reads over the network. To limit where, attach an egress policy.
  • Codex keeps its login in ~/.codex/auth.json in the guest home, so the agent can read it.

OpenAI's documentation says that with these flags in a dev container, "a malicious project can exfiltrate anything available inside the devcontainer, including Codex credentials". An egress policy limits where that data can go.

Sources #

Read on 2026-11-04.

Type a command, a flag or an error message.