Run OpenAI Codex CLI on Linux without breaking anything

Published August 28, 2026

Most people install Codex CLI, fire it up, and only think about sandbox settings after it has already modified something they needed. This guide reverses that order. You’ll install the agent, sign in from a headless server if necessary, and understand exactly which flags control what it can touch before it touches anything.

Everything here was tested on Ubuntu 26.04 and RHEL 10. The commands work on any modern Linux distribution running 64-bit x86 or ARM.

What Codex CLI Actually Does

Codex CLI is OpenAI’s coding agent that runs directly in your terminal. It reads your repository, suggests and applies edits, runs commands like ls and grep, executes your test suite, and shows you a diff of every change it made.

That last detail matters. This is not a chat window where you copy and paste suggested code. Codex runs commands in your shell and makes changes on your system. The sandbox configuration below is worth reading carefully before you hand it access to anything real.

Three Ways to Install Codex CLI

Option 1: The official install script

The quickest path is the official script. It downloads a prebuilt binary and drops it on your PATH.

curl -fsSL https://chatgpt.com/codex/install.sh | sh

What each flag does: -f makes curl fail on server errors instead of saving an HTML error page, -s runs silently, -S still shows real error messages, and -L follows redirects. The pipe to sh executes whatever the server sends directly.

That last part is the risk. If you’re installing on a system you don’t own, download the script first and review it before running it.

curl -fsSL https://chatgpt.com/codex/install.sh -o codex-install.sh

Option 2: npm global install

If you prefer Node.js, install Node.js and npm first. The package manager command depends on your distribution.

Ubuntu/Debian:

sudo apt install nodejs npm

RHEL/Rocky Linux:

sudo dnf install nodejs npm

Then install the Codex package globally:

npm install -g @openai/codex

Option 3: Static binary from GitHub

The latest GitHub release includes static binaries. On a 64-bit Intel or AMD system, download codex-x86_64-unknown-linux-musl.tar.gz, extract it, rename the binary to codex, and move it to a directory in your PATH.

Verify the install

Whichever method you used, confirm Codex is available:

codex --version

A version number means it’s installed and on your PATH. If you get command not found, jump to the troubleshooting section below.

Sign In From a Headless Server

The first time you run codex, it asks you to sign in. On a desktop, it opens your browser and completes the ChatGPT OAuth flow automatically. On a server you reach over SSH, there’s no browser available.

Use the device authentication flow instead:

codex login --device-auth

Codex displays a short code and a URL. Open the URL on your local machine, enter the code, and the server completes authentication without launching a browser locally.

Codex is included with ChatGPT Plus, Pro, Business, Edu, and Enterprise plans. For automation use cases, you can authenticate with an API key through an environment variable:

printenv OPENAI_API_KEY | codex login --with-api-key

Check your authentication status at any point with:

codex login status

This exits with status 0 when valid credentials are available, which makes it useful as a quick check at the top of a shell script.

️ Sandbox Modes: The Setting That Actually Matters

Codex separates two questions that are easy to conflate: what can the agent access, and when should it stop and ask you? The --sandbox flag (or -s) controls access. The --ask-for-approval flag (or -a) controls when it pauses.

Sandbox levels

read-only: Codex can read files and run non-modifying commands. Nothing on disk changes.
workspace-write: Codex can modify files inside the current working directory only, not elsewhere.
danger-full-access: No sandbox boundary. The agent can access anything your user account can access.

Approval policy options

untrusted: Pauses for any command Codex doesn’t already consider safe.
on-request: Codex asks when it needs to act outside the sandbox boundary.
never: Runs the entire session without asking for approval.

The combination worth defaulting to

For everyday work in a repository, this is the right starting point:

codex --sandbox workspace-write --ask-for-approval on-request

This gives Codex enough access to edit code and run tests without pausing every few seconds, while keeping it inside the directory where you started it. If it needs to reach outside that directory, you get a chance to approve the action.

If a task genuinely requires access to another directory, grant access explicitly rather than weakening the sandbox:

codex --sandbox workspace-write --add-dir /var/www/

⚠️ The Flag You Shouldn’t Reach For

Codex includes a --dangerously-bypass-approvals-and-sandbox flag, aliased as --yolo, which disables both approval prompts and sandboxing entirely. The name is an accurate warning.

The only safe place to use it is inside a container or throwaway VM that’s already isolated at the OS level. On a machine with real data, workspace-write with on-request gives you a workable balance of speed and protection.

Slash Commands Worth Knowing

Inside the terminal UI, type / to open the command popup. These are the most useful commands:

/status: Shows the active model, approval policy, writable roots, and remaining context. Run this first in every session to confirm Codex is using the sandbox you expect.
/diff: Shows the Git diff of everything Codex changed, including untracked files.
/review: Asks Codex to review your working tree for behavior changes or missing tests.
/compact: Summarizes the conversation and frees up context during a long session.
/permissions: Changes the approval preset without restarting Codex.
/model: Switches the active model before a more demanding task.

Running /status immediately after starting a session is also useful for catching cases where an existing ~/.codex/config.toml setting is silently overriding the flags you passed on the command line.

Run Codex Against a Local Model

If you want to keep your code and requests on your own hardware, the --oss flag routes Codex to a local model provider instead of OpenAI’s hosted models.

codex --oss --local-provider ollama

LM Studio is also supported:

codex --oss --local-provider lmstudio

Local models may not perform as well as hosted models on larger or more complex coding tasks, but they give you full control over where your code and requests are processed.

Run Codex Non-Interactively With `codex exec`

The terminal UI works well when you’re at the keyboard. For cron jobs and CI pipelines, use codex exec (also available as codex e), which runs a single task and exits.

codex exec --sandbox read-only -o /tmp/audit.md "Summarise every systemd unit in this repo that runs as root"

What each part does: --sandbox read-only prevents changes, which is what you want for an audit. -o /tmp/audit.md saves the final response to a file. The quoted string is the prompt. Use - instead to read the prompt from standard input.

Two more options become useful in scripts. --json outputs newline-delimited JSON events instead of formatted text, making it easy to pipe into jq. --skip-git-repo-check allows Codex to run in a directory that isn’t a Git repository, which it otherwise refuses.

If a scripted run stops partway through, resume it without starting over:

codex exec resume --last

Set Standing Instructions With AGENTS.md

Codex reads an AGENTS.md file from the working directory and uses it as standing instructions for every session. Create a starter scaffold from inside a Codex session:

/init

Edit the file to include the rules that matter for your project: which test command to run, which directories are generated and should not be edited manually, and any deployment step Codex must never run automatically. Commit the file to your repository so you don’t repeat the same onboarding in every new session.

Common Pitfalls

Command not found after install

Both the install script and npm install -g place the codex binary in a directory your current shell may not have picked up yet. Open a new shell and try again first. If the command is still missing, check where npm puts global binaries:

npm config get prefix

Add the corresponding bin directory to your PATH in ~/.bashrc, reload the shell, and run codex --version to confirm.

General diagnostics

Codex has a built-in diagnostic command that checks installation, configuration, authentication, runtime, Git, and terminal setup in one pass:

codex doctor --summary

The --summary flag shows grouped results and a final count rather than the full report. For more detail, run it without the flag. For a bug report, add --json; the output is redacted.

Deprecated flags

The old --full-auto flag is deprecated and displays a warning. Use --sandbox workspace-write instead. The codex mcp-server command has been replaced by the Codex app server.

Where to Start

Pick a repository you know well and run:

codex --sandbox read-only

Ask Codex to explain a file you’re already familiar with. Because the session is read-only, it can’t modify anything. You can evaluate the quality of its answers before granting it permission to make changes. That’s the right order of operations.

Cagri Sarigoz( Founder )

I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.

With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.

At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.

And more than all else, I’m a father to a (always) little girl and a husband.

Contact me at [email protected] for assistance.