Split config and session state directories via env var to enable RO Docker mount of ~/.codex
Resolved 💬 3 comments Opened Jan 1, 2026 by ardigan6 Closed Feb 23, 2026
💡 Likely answer: A maintainer (etraut-openai, contributor)
responded on this thread — see the highlighted reply below.
What feature would you like to see?
Currently, CODEX_HOME stores both configs and session state.
What we want is to mount CODEX_HOME read-only in our docker dev env, and tell codex to write state to SESSION_HOME set to /tmp.
Instead, the most obvious answer is to copy files into the container on build, which is both bad practice and less flexible.
Additional information
_No response_
3 Comments
As a workaround, you might want to experiment with symlinks.
There are several workarounds: OverlayFS, symlinking individual files from a mount point into a writeable dir, directly mounting files RO, etc.
They all have bad tradeoffs compared to not mixing config and state together in a single dir, especially for an app that should really be running in a sandbox all the time.
I opted for directly mounting auth/config as immutable files, and then symlinking them into a temp dir for CODEX_HOME, but looks pretty ugly to me.
This feature request hasn't received any upvotes, so I'm going to close it.