Back to Blog

ARTICLE // INSIGHTS

Codex Sandbox Environments in Your Own Kubernetes Cluster

Camil Blanaru / 24 Jul, 2026
Codex Sandbox Environments in Your Own Kubernetes Cluster

Edka can now run Codex sandbox environments in your own Kubernetes cluster.

Each environment checks out one GitHub repository at the branch you choose, keeps its workspace on its own persistent volume, and accepts TLS connections from the Codex CLI on your computer. Edka creates and removes the pod, storage, route, and credentials; everything stays in your cluster.

What you get:

  • Fast sandboxes: Sign in once with a ChatGPT subscription or an OpenAI Project API key, then create environments for any repository.
  • Credentials stay out of the workspace: The subscription credential or API key lives in a Kubernetes Secret and a credential proxy. Workspace containers receive short-lived access and never see the key.
  • Pull requests through your existing GitHub integration: Each environment gets a rotating token scoped to its repository, enough to push branches and open, update, and review pull requests. No new GitHub setup is required.
  • Sessions that outlive your laptop: Work continues when your machine sleeps or goes offline. Clones and build caches stay on the volume between sessions.
  • Parallel work on one repository: Any number of environments can clone the same repository without sharing state.
  • Contained full access: Codex runs with approvals off inside a non-root pod with no Kubernetes API credentials. Its network reaches only DNS and the public web; cluster services, other pods, and private networks stay unreachable.

Environments do not need a public endpoint. A wildcard domain on a Tailscale tailnet Gateway, or on a private Gateway that clients reach through Cloudflare WARP, keeps them reachable only from your network.

One agent, many environments

The Codex Agent is the hub; environments are the workspaces under it. The agent holds the ChatGPT sign-in or API key, the wildcard domain, and the network policy. It keeps no idle worker running: environments come and go beneath it, each one a checkout of one repository.

Deploy the Codex Agent from Workloads → Agents, then pick the wildcard domain for environment endpoints and a sign-in method.

A cluster can run several Codex agents side by side, each with its own ChatGPT subscription or API key: one per teammate, or one per billing scope.

Create an environment for a repository

Open the agent’s Environments tab and choose a GitHub repository and branch. You can also set a name, resource size (1 CPU and 1 GiB up to 8 CPU and 8 GiB), storage class, and an auto-delete time from one hour to 90 days.

Edka shows a live progress bar while it creates the environment. Once it runs, the environment page shows the endpoint, CPU and memory use, pod, and logs. Delete it to remove the pod, volume, route, and credentials; push anything you want to keep first. Auto-delete does the same on a timer, so short jobs do not leave pods and volumes running.

Keep provider credentials out of the workspace

  • ChatGPT Subscription: Sign in with a one-time device code in the deploy form; the credential never passes through your browser. Edka stores it in a Kubernetes Secret in your cluster, and the credential proxy hands environments short-lived access.
  • OpenAI Project API Key: Edka stores the key in a Kubernetes Secret and mounts it only in the proxy sidecar, never in the clone or workspace containers. Use a project key with its own budget. Replace it in the agent settings and Edka restarts the environments with the new key.

Attach from your local Codex CLI

Open a running environment, select Reveal Connection, and complete the passkey check. Edka issues a short-lived token for that environment and gives you a command like this:

Terminal window
export EDKA_CODEX_TOKEN='...'
codex --dangerously-bypass-approvals-and-sandbox \
  --remote wss://<environment-endpoint> \
  --remote-auth-token-env EDKA_CODEX_TOKEN

The remote session has full access inside the environment pod. Codex runs its commands in the pod, not on your computer. OpenAI’s Codex CLI sends remote auth tokens only over wss:// or a local ws:// address.

Connection tokens expire after an hour and work for one environment. Reveal a new connection when you need to reconnect.

Use a private domain

The Codex Agent lists TLS-enabled wildcard domains that use an Envoy Gateway traffic class. For private access, choose one of these paths:

  • Tailscale: Add the wildcard domain to a Tailscale tailnet (BYOD) Gateway class. Connect your computer to the tailnet.
  • Cloudflare Zero Trust: Add a DNS-validated wildcard domain to a MetalLB private VIP Gateway class. Install the Cloudflare connector and connect your computer through WARP.

The Cloudflare connector routes the cluster’s private subnet. Edka’s Domains flow still manages the hostname and TLS certificate.

Both paths keep the endpoint off the public internet. A short-lived token still protects each connection.

The pod is the sandbox

Codex runs with approvals off inside the environment, so the pod carries the isolation. Each environment runs as a non-root user with a read-only root filesystem, dropped Linux capabilities, and no Kubernetes API credentials.

During setup, Edka gives the environment a GitHub installation token for its selected repository. The token grants Contents and Pull requests write access and expires within an hour. Edka keeps replacing it for as long as the environment runs, so pushes keep working and a leaked token dies within the hour.

A network policy, on by default, blocks everything a coding session does not need. Inbound, only the Envoy Gateway can reach the environment, on one port. Outbound, the environment can resolve DNS and reach public HTTP and HTTPS addresses. Cluster services, other pods, node metadata endpoints, and private network ranges are unreachable. You can adjust the policy in the agent’s Settings → Security tab.

Get started

You need:

  • a TLS wildcard domain on an Envoy Gateway traffic class, preferably one that clients reach through Tailscale or Cloudflare WARP;
  • the GitHub integration connected, with access to the repositories you want to use;
  • a ChatGPT subscription or an OpenAI Project API key; and
  • the Codex CLI (0.145 or newer) on your computer.

Read the Codex environments docs for the full setup. You can also review the Tailscale, Cloudflare Zero Trust, GitHub integration, and domains and TLS guides.

Create an Edka account to run Codex in your own cluster.

Back to All Posts