CLI login OAuth callback port is fixed, causing port conflicts when multiple Dev Containers are running

What version of Codex CLI is running?

codex-cli 0.139.0

What subscription do you have?

ChatGPT Plus

Which model were you using?

N/A - this happens during codex login, before model selection.

What platform is your computer?

Host OS: Windows,Dev Container OS: Alpine

What terminal emulator and version are you using (if applicable)?

What terminal emulator and version are you using? VS Code integrated terminal inside Dev Container

Codex doctor report

What issue are you seeing?

When running Codex CLI login from multiple Dev Containers, the local OAuth callback server uses fixed ports and can collide with another running login server.

The login implementation appears to use a fixed default callback port 1455 and a fixed fallback port 1457. There does not appear to be a CLI option such as --login-port to override the callback port.

I tried:

codex auth login --login-port 1458

and got:

error: unexpected argument '--login-port' found

Usage: codex login [OPTIONS] [COMMAND]

This is painful in Dev Container workflows because multiple containers may be running at the same time. If one container or login process already occupies the fixed callback port, another container cannot choose a different callback port.

What steps can reproduce the bug?

1. Start one Dev Container.
2. Run codex login.
3. Start another Dev Container on the same host.
4. Run codex login again.
5. Observe that the OAuth callback port is fixed and can conflict.
6. Try to specify a different port, for example:
7. codex login --login-port 1458

or:

codex auth login --login-port 1458
Observe that the CLI rejects the port option as an unexpected argument.

What is the expected behavior?

Codex CLI should support one of the following:

A login callback port override, for example:
codex login --login-port 1458

An environment variable override, for example:

CODEX_LOGIN_PORT=1458 codex login

Automatic selection of an available registered callback port.
Clear documentation that browser-based login only supports fixed callback ports and that Dev Container/headless users should use:

codex login --device-auth

Additional information

The workaround is to use device authentication:

codex login --device-auth

However, browser-based login is still the default flow, and the fixed callback port behavior is surprising in multi-container development environments.

Related source:
codex-rs/login/src/server.rs

The implementation appears to define a fixed DEFAULT_PORT and FALLBACK_PORT, and there does not seem to be a public CLI option to override them.