# How do I run OpenAI Codex on an always-on Linux computer instead of my laptop? > Install the Codex CLI on a Linux machine that stays on, sign in with a device code or API key, and run it in a terminal session that survives disconnects, for example on a Sanbox Computer. - Source: Sanbox knowledge base, by Sanlabs GmbH - URL: https://sanbox.cloud/kb/coding-agents/codex-on-an-always-on-linux-computer/ - Type: how-to - Section: Coding agents in the cloud - Language: en - Published: 2026-11-06 - Updated: 2026-11-06 Install the Codex CLI on a Linux machine that stays on, sign in with a device code or an API key, and run it inside a terminal session that keeps going when you disconnect. OpenAI's desktop app can now open projects on an SSH host, but that host is still a machine you have to run. On Sanbox, you install Codex on an OpenCode Computer, which stays running until you stop it, keeps its disk across stops, and is reachable from the console's browser terminal or `sanbox ssh`. ## Run this with your agent ```text Read https://sanbox.cloud/kb/coding-agents/codex-on-an-always-on-linux-computer.md and follow it to run Codex on an always-on Computer. If the Sanbox CLI is missing, install it with `npm install -g @sanlabs/sanbox-cli@latest` and sign in with `sanbox login`. Show me each command before you create, stop or delete a Computer. ``` ## What did people ask for? In [openai/codex#10450](https://github.com/openai/codex/issues/10450), "Remote Development in Codex Desktop App", users asked to work on code that lives on remote hosts, as VS Code Remote SSH allows. It drew 879 reactions and was closed as completed in May 2026. OpenAI's docs now describe remote connections: you add the host to `~/.ssh/config`, install and sign in to Codex on that host, and the desktop app runs commands and edits files there. Phone control through the ChatGPT mobile app goes to a macOS or Windows machine running the desktop app, which has to stay awake. So you still need an always-on Linux machine. The steps below use a Sanbox Computer; the Codex parts work the same on any server. ## Steps ### 1. Allow the hosts Codex needs Save this as `codex-policy.json`: ```json { "default_action": "deny", "rules": [ { "destination": "registry.npmjs.org", "ports": [{ "from": 443, "to": 443 }] }, { "destination": "api.openai.com", "ports": [{ "from": 443, "to": 443 }] }, { "destination": "auth.openai.com", "ports": [{ "from": 443, "to": 443 }] }, { "destination": "chatgpt.com", "ports": [{ "from": 443, "to": 443 }] }, { "destination": "github.com", "ports": [{ "from": 443, "to": 443 }] } ] } ``` `registry.npmjs.org` serves the install and `api.openai.com` the API. `auth.openai.com` (sign-in) and `chatgpt.com` (requests on your ChatGPT plan) appear in Codex's source; you need them only for ChatGPT sign-in. Check this list against OpenAI's current docs; a blocked request names the host it couldn't reach. `github.com` is for cloning. ### 2. Create and start an OpenCode Computer The image has Node, npm, git and the zellij terminal multiplexer. Its own OpenCode agent needs a model provider from your organisation: ```bash sanbox model-providers list --json sanbox templates create --name "Codex" --type opencode-computer \ --model-provider --model \ --network-policy codex-policy.json --json sanbox templates validate --json sanbox run --template --external-run-id codex-main --json sanbox runs get --json ``` Wait until the state is `running`. Don't use `--wait` on `sanbox run`; for a Computer it waits until the Computer stops. ### 3. Install Codex ```bash sanbox exec --root -- npm install -g @openai/codex sanbox exec -- codex --version ``` OpenAI also publishes a standalone installer for macOS and Linux (`curl -fsSL https://chatgpt.com/codex/install.sh | sh`). The npm package is used here because the policy already allows npm. Update Codex later by rerunning the same install command. ### 4. Open a terminal that survives disconnects Use the console's browser terminal: each terminal is a zellij session that keeps running when you close the tab or lose the network, and you can reopen it from another device. Or, from your own terminal: ```bash sanbox ssh ``` Then, inside the Computer: ```bash zellij attach --create codex ``` If your SSH connection drops, run `sanbox ssh ` and `zellij attach codex` to get back. The console terminal and SSH can use different home directories, which is where Codex keeps its login, so sign in from the one you'll keep using. ### 5. Sign in With your ChatGPT plan, use a device code. Turn on device code login in your ChatGPT security settings first (workspace admins allow it in workspace permissions), then: ```bash codex login --device-auth ``` Open the link on any device, sign in and enter the one-time code. OpenAI marks device code sign-in as beta. With an API key, which OpenAI recommends for automation, read it without echoing it and pipe it in: ```bash read -rs OPENAI_API_KEY && export OPENAI_API_KEY printenv OPENAI_API_KEY | codex login --with-api-key unset OPENAI_API_KEY ``` Codex caches the login in `~/.codex/auth.json` or your system's credential store. Treat that file like a password. ### 6. Run Codex ```bash cd /workspace git clone https://github.com//.git cd codex ``` Close the tab or the SSH window; Codex keeps working in the zellij session. ### 7. Stop and resume ```bash sanbox runs stop --wait --json sanbox runs resume --wait --json ``` Stop ends Codex and every other process. The disk is kept: the repository, the Codex install and its login. After a resume, open a terminal and start Codex again. ## Lock down egress If you sign in with an API key, remove `auth.openai.com` and `chatgpt.com`. Add package registries your project needs, such as `pypi.org`, as separate rules. ## Snapshot it Stop the Computer after installing Codex and cloning the repository, but before you sign in, and save it. New Computers from the snapshot start ready, without your login: ```bash sanbox runs stop --wait --json sanbox snapshots create --run --name codex-base --wait sanbox run --snapshot codex-base --json ``` ## What this doesn't do - Sanbox doesn't document using a Computer as an SSH remote host for OpenAI's desktop app. Run the Codex CLI inside the Computer instead. - The ChatGPT mobile app's remote control doesn't reach the Computer. Use the console terminal in your phone's browser, and check how it handles your phone's keyboard. - It doesn't keep processes through a stop, and nothing stops or schedules it for you. A running Computer stays on until you stop it. - Your Codex login is a file on the Computer's disk. Forks and snapshots copy it, and anyone in your organisation who can open the run's terminal can use it. Plan logins are personal: on a Computer several people share, use an API key. - Model usage is billed by OpenAI under your plan or API key. Your Sanbox plan, agreed per organisation, covers the Computer. ## Related - [How do I log in to Claude Code or Codex on a headless server?](https://sanbox.cloud/kb/coding-agents/log-in-to-claude-code-or-codex-on-a-headless-machine/) - [How do I keep Claude Code running 24/7 and control it from my phone?](https://sanbox.cloud/kb/coding-agents/claude-code-24-7-from-your-phone/) - [How do I run 10 coding-agent tasks in parallel without them clashing?](https://sanbox.cloud/kb/parallel-work/run-coding-agent-tasks-in-parallel/) - [What survives when an agent's computer stops?](https://sanbox.cloud/kb/agent-computers/what-survives-a-stop/) ## Sources - GitHub, [openai/codex#10450](https://github.com/openai/codex/issues/10450): title, closed as completed on 2026-05-14. Checked 2026-11-06. - OpenAI docs, [Remote connections](https://learn.chatgpt.com/docs/remote-connections): SSH hosts and mobile control. Checked 2026-11-06. - OpenAI docs, [Authentication](https://learn.chatgpt.com/docs/auth): device code, API key login, `auth.json`, API keys for automation. Checked 2026-11-06. - OpenAI docs, [Codex CLI](https://learn.chatgpt.com/docs/codex/cli): standalone installer. Checked 2026-11-06. - GitHub, [openai/codex README and source](https://github.com/openai/codex): `npm install -g @openai/codex`, sign-in host `auth.openai.com` and ChatGPT backend `chatgpt.com`. Checked 2026-11-06. ## Next step Talk to us at sales@sanlabs.ai. Sanlabs' forward-deployed engineers build agent use cases with your team, with experience in aviation, pharmaceuticals, supply chain and logistics, and internal admin workflows. How we work: https://sanbox.cloud/kb/teams/forward-deployed-engineering.md Existing customers can use Sanbox from a coding agent: install the CLI with `npm install -g @sanlabs/sanbox-cli@latest`, sign in with `sanbox login`, then run `sanbox skill` for the full agent guide.