Add OpenAI Codex Cloud sandbox environment support - #2244
Merged
Merged
Conversation
Codex cloud containers cannot run Docker: the kernel blocks user namespace creation, so installing the binary does not help. `mise run cloud:init` therefore died at the `cloud:start` step with "Unable to run docker: spawnSync docker ENOENT", leaving the environment unbootable. Gate the Docker-backed startup path behind SANDBOX=1 rather than removing it, so local development keeps starting Postgres, ClickHouse, and Redis and keeps hard-failing when the daemon is genuinely down. Add a `test:sandbox` task so work is still verifiable without those services: every package's typecheck, biome, and the Docker-free unit and mobile test tiers. Integration coverage remains a CI gate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FosqbddopEXkiCfhRfTMav
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
LGTM! The changes cleanly check 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
Contributor
Reviewer's GuideAdds first-class support for running dev workflows in OpenAI Codex Cloud’s Docker-less sandbox by gating Docker-dependent startup behind SANDBOX=1, introducing a Docker-free Sequence diagram for cloud:init and sandbox-aware startupsequenceDiagram
participant Developer
participant Mise
participant Task_cloud_init
participant Dev_environment_start
participant Docker
participant Compose_up
participant Setup_db
Developer->>Mise: mise run cloud:init
Mise->>Task_cloud_init: run cloud:prebuild
Task_cloud_init-->>Mise: prebuild complete
Mise->>Task_cloud_init: run cloud:start
Task_cloud_init->>Dev_environment_start: start()
alt SANDBOX == 1
Dev_environment_start-->>Task_cloud_init: write SANDBOX=1 skip message
else SANDBOX != 1
Dev_environment_start->>Docker: runCommand docker info
Dev_environment_start->>Compose_up: runCommand pnpm compose:up
Dev_environment_start->>Setup_db: runCommand pnpm setup-db
end
Flow diagram for SANDBOX handling in dev-environment startflowchart TD
Start[call start]
Check{SANDBOX == 1}
Start --> Check
Check -- Yes --> Msg[write SANDBOX=1 skip message]
Msg --> End[return]
Check -- No --> Docker[runCommand docker info]
Docker --> Compose[runCommand pnpm compose:up]
Compose --> SetupDB[runCommand pnpm setup-db]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary by QodoSupport Docker-free OpenAI Codex Cloud sandboxes
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
Asherlc
enabled auto-merge
July 28, 2026 17:56
📝 WalkthroughWalkthroughAdds Codex Cloud guidance, a ChangesCodex sandbox workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 1 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (1 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review by Qodo
Context used✅ Compliance rules (platform):
147 rules✅ Skills:
fix-provider, write-tests, cloudflare 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Review flagged two real gaps. `test:sandbox` ran biome directly, skipping `lint:suppressions`, `lint:workflow-downloads`, `lint:exact-versions`, `lint:analytics-policy`, `lint:mobile-telemetry`, and `lint:web-stories` — all pure Node/git checks that run fine without Docker, so policy violations could pass the sandbox gate and fail CI instead. Extract `lint:sandbox` as `pnpm lint` minus `lint:analytics-sql`, the one policy that needs uv and a running ClickHouse, and define `lint` in terms of it so the two cannot drift. The Docker claim in AGENTS.md had no primary source, because OpenAI does not document it. Attribute it to our own setup logs as an observed limitation instead of implying documented behavior, and tighten the section. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FosqbddopEXkiCfhRfTMav
|
LGTM 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Around line 271-285: Add one blank line after each new Markdown heading in
AGENTS.md: “There is no Docker — do not try to install it,” “Boot the
environment with SANDBOX=1,” “Verify work with mise run test:sandbox,” “Still
write integration tests — flag them as locally unverified,” and “Secrets are
gone by the time you run,” before their following paragraphs, preserving all
content unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 67bc53a1-357f-4fcd-8d12-6f5c913baafd
📒 Files selected for processing (4)
AGENTS.mdmise.tomlscripts/dev-environment.test.tsscripts/dev-environment.ts
Contributor
|
Storybook previews for This comment updates automatically on each PR push. |
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add support for running development tasks in OpenAI's Codex Cloud sandbox environment, which lacks Docker and requires special handling for service startup and testing workflows.
Changes
AGENTS.md: Added comprehensive "OpenAI Codex Cloud specific instructions" section documenting:
SANDBOX=1environment variable to skip Docker-dependent service startupmise run test:sandboxverification gate for Docker-free checks (typecheck, biome, unit/mobile tests)scripts/dev-environment.ts: Modified
start()function to detectSANDBOX=1and skip Docker-backed service startup (Postgres, ClickHouse, Kafka, Redis) with an informative message directing users totest:sandboxscripts/dev-environment.test.ts: Added test coverage for sandbox mode:
sandboxoption in test fixturesSANDBOX=1skips all service startup commands and returns successmise.toml: Added
test:sandboxtask that runs Docker-free verification:Implementation Details
The
SANDBOX=1check is a simple early return in thestart()function, preventing any Docker commands from being invoked. This allowsmise run cloud:initto complete successfully by runningcloud:prebuild(dependencies, CodeGraph, RTK) while skipping the Docker-dependentcloud:startpath. Thetest:sandboxtask provides the closest equivalent to local pre-push checks within the sandbox constraints.https://claude.ai/code/session_01FosqbddopEXkiCfhRfTMav
Summary by Sourcery
Add support for running the dev environment and verification checks in Docker-less OpenAI Codex Cloud sandboxes using a SANDBOX=1 mode and a new sandbox test task.
New Features:
Enhancements:
Summary by cubic
Adds sandbox support for OpenAI Codex Cloud by skipping Docker-backed services when
SANDBOX=1and adding a Docker-freetest:sandboxtask with full Node-only lint policies. This letsmise run cloud:initsucceed in the sandbox while keeping integration tests CI-only.New Features
scripts/dev-environment.ts:start()exits early whenSANDBOX=1and skips Docker services.mise.toml: Addedtest:sandbox(recursive typecheck,pnpm lint:sandbox, unit/mobile tests).package.json: Addedlint:sandbox(Node-only lint checks) and redefinedlintaslint:sandbox+lint:analytics-sql.scripts/dev-environment.test.ts: Test verifiesSANDBOX=1skips all service startup and succeeds.AGENTS.md: Updated Codex Cloud guidance; cites the Docker limit as observed in setup logs, explainsSANDBOX=1,test:sandbox, and CI gating for integration tests.Migration
SANDBOX=1and runmise run cloud:init.mise run test:sandboxto verify; integration tests run in CI.Written for commit 44e60b6. Summary will update on new commits.
Summary by CodeRabbit
New Features
Documentation
Tests