[Question] How to configure Codex CLI to Read and Write only in the current directory?
Resolved 💬 5 comments Opened Aug 31, 2025 by hitnova Closed Oct 29, 2025
💡 Likely answer: A maintainer (etraut-openai, contributor)
responded on this thread — see the highlighted reply below.
I need to ensure the strict access only for the Codex CLI to the current working directory on MacOS with hard functional restriction - not just with prompt like "Do not read files in other directories".
Is it possible to configure like that, may be with seatbelt configuration?
5 Comments
In read only mode codex reads whole filesystem. So your /etc/password file could leak
Please refer to this thread for details. Codex requires read access to parts of the file system other than your working directory. You can run it within a docker container or VM if you'd like stricter isolation.
@hitnova You can try: https://github.com/openai/codex/pull/5024
@etraut-openai But being able to access a system tool (like cat/ls/whatever) doesn't mean the agent should be able to..say, run said system tool in any directory on my machine, no? There should be a difference between the two.
I catch Codex scanning context of files outside of its working directory. 🤕