Split config and session state directories via env var to enable RO Docker mount of ~/.codex

[ardigan6]

What feature would you like to see?

Currently, CODEX_HOME stores both configs and session state.

What we want is to mount CODEX_HOME read-only in our docker dev env, and tell codex to write state to SESSION_HOME set to /tmp.

Instead, the most obvious answer is to copy files into the container on build, which is both bad practice and less flexible.

Additional information

No response

[etraut-openai]

As a workaround, you might want to experiment with symlinks.

[ardigan6]

As a workaround, you might want to experiment with symlinks.

There are several workarounds: OverlayFS, symlinking individual files from a mount point into a writeable dir, directly mounting files RO, etc.

They all have bad tradeoffs compared to not mixing config and state together in a single dir, especially for an app that should really be running in a sandbox all the time.

I opted for directly mounting auth/config as immutable files, and then symlinking them into a temp dir for CODEX_HOME, but looks pretty ugly to me.