OpenAI Codex CLI

Default sandbox mode is workspace-write, read anywhere, write only in the workspace, no network unless explicitly enabled. On Linux it uses bubblewrap + seccomp, with Landlock as its original mechanism kept as a compatibility fallback (Landlock is the newer kernel feature; 'fallback' refers to Codex's implementation history, not tech age). macOS uses Seatbelt. Codex Cloud runs in OpenAI-managed containers, offline by default during the agent phase.