Engineering Security Building a safe, effective sandbox to enable Codex on Windows
Implement the unelevated sandbox using synthetic SIDs and write‑restricted tokens to limit file writes and network access for Codex on Windows without admin elevation.
Deploy: Configure the sandbox by creating sandbox‑write SID, setting ACLs, and applying proxy overrides on Windows developer machines.
Summary
Codex on Windows lacked a sandbox, forcing users to approve every command or run in full access mode. The team built an unelevated sandbox using synthetic SIDs and write‑restricted tokens to limit file writes and network access without admin elevation.
The sandbox grants a synthetic SID sandbox‑write write, execute, and delete access to the current working directory and configured writable roots, while denying write to .git, .codex, and .agents directories.
Codex commands run under a write‑restricted token whose restricted SID list includes Everyone, the current session SID, and sandbox‑write, ensuring only approved writes occur.
Network access is limited by proxy environment variables and stub SSH/SCP scripts that fail immediately, preventing Git and package installers from reaching the internet.
AppContainer, Windows Sandbox, and Mandatory Integrity Control were evaluated but rejected due to scope, availability, or broad filesystem impact.
The prototype works without requiring elevation and provides the necessary isolation for Codex on Windows.
Key changes
- No native Windows sandboxing for Codex; custom unelevated sandbox built.
- Uses synthetic SID sandbox‑write granted write/execute/delete to cwd and writable_roots.
- Denies write to .git, .codex, .agents directories.
- Launches Codex commands under write‑restricted token with restricted SID list.
- Limits network access via proxy env vars and stub SSH/SCP scripts.
- AppContainer, Windows Sandbox, and MIC rejected due to scope or filesystem impact.
- Prototype works without requiring elevation.
- Provides necessary isolation for Codex on Windows.