Feature: Allow password-less sudo when running codex in docker container
Resolved 💬 3 comments Opened Apr 19, 2025 by BadPirate Closed Nov 16, 2025
💡 Likely answer: A maintainer (BadPirate, contributor)
responded on this thread — see the highlighted reply below.
While there is some risk to allowing sudo to a resident of a docker container it is pretty limited. The advantage would be that agent could install tools that it is missing into the local container when asked. Combine that with a feature to allow persisting container between executions and the recently added change that has one container name per workspace, and an AI could customize its containerized running environment to suit its purposes. I think that would be pretty rad.
Proposal
Add a --allow-sudo flag to run_in_container.sh
3 Comments
Updated to marking all of this as dangerous, as while sudo inside a VM can't do much damage, it can be used to disable the firewall, and make dangerous outbound network calls :) see 4b7f018
Even if there are better patterns for custom container build modification, I think I still like having this flag because of all the unconventional use cases. IMO, label it dangerous, but allow it, I can think of some interesting projects (especially headless) where the risk of sudo is outweighed by it's capabilities :)
This feature request has been open for more than six months and hasn't received any upvotes, so I'm going to close it.