ExternalSandbox configurable with config.toml/cli

@apanasenko-oai would you might know if this is in plans or is it by design the external-sandbox is only in app-server?

Hi @mastrzyz ,

Could you tell me a little bit more about use case where you would like to use external sandbox and not DangerFullAccess?

Thanks

Hi @mastrzyz , Could you tell me a little bit more about use case where you would like to use external sandbox and not DangerFullAccess? Thanks

@apanasenko-oai I’m using it in a CI environment where we have VM imaged every time they are used .

So I’m not afraid of breaking the machine but would not like external network requests going out .

Ie a network sandbox

So I’m not afraid of breaking the machine but would not like external network requests going out .

I see, just to make sure we’re on the same page: with external-sandbox, sandboxing is assumed to happen outside of codex-cli. It’s your responsibility to control and enforce network restrictions externally; the API merely tells the model what has been configured. Nothing in the codex-cli code itself enforces these restrictions.

If this works for your use case, we can wire these settings into the configuration as well. Are you using codex exec, or something else?

> So I’m not afraid of breaking the machine but would not like external network requests going out . I see, just to make sure we’re on the same page: with external-sandbox, sandboxing is assumed to happen outside of codex-cli. It’s your responsibility to control and enforce network restrictions externally; the API merely tells the model what has been configured. Nothing in the codex-cli code itself enforces these restrictions. If this works for your use case, we can wire these settings into the configuration as well. Are you using codex exec, or something else?

Codex exec . Understood as well thanks for clarifying !

This feature request hasn't received any upvotes, so I'm going to close it.