Install Codex CLI with file-based auth - #12
Merged
Merged
Conversation
Install the Codex CLI in the devcontainer image (Layer 6, alongside the Claude install), and provision its credentials the same way as the gcloud/Vertex ones: - create_dev_user.sh prompts for a codex auth.json path and uploads it as the <username>-codex-config secret. - Both deployments mount that secret read-only at ~/.codex/auth.json via subPath, so Codex uses file-based auth while the rest of ~/.codex stays writable. Intended for a static OpenAI API key in auth.json (no token refresh), so the read-only mount is sufficient.
Both images install the Claude CLI in Layer 6; add the Codex install next to it, matching the main Dockerfile. runtime.Dockerfile is left alone since it inherits its tooling from the shared build rather than installing Claude itself.
skpark-rh
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the Codex CLI to the devcontainer and provisions its credentials using the same file-based pattern as the existing gcloud/Vertex setup.
Changes
.devcontainer/Dockerfile: install Codex in Layer 6 right after Claude, viacurl -fsSL https://chatgpt.com/codex/install.sh | HOME=/home/devuser bash(installs into devuser's home;~/.local/binis already onPATH).create_dev_user.sh: new requiredcodex auth.json pathprompt; uploads it as the<username>-codex-configsecret (delete-then-create, mirroring the gcloud block).deployment/deployment.yml+deployment-rdma.yml: mount that secret read-only at~/.codex/auth.jsonviasubPath, analogous to the gcloud creds mount.Auth method
Uses Codex's file credential store (
$CODEX_HOME/auth.json, default~/.codex), per the auth docs. AsubPathmount is used (rather than mounting the whole dir like gcloud) so~/.codexstays writable for Codex's config/logs/session state on the PVC — matching the existingbazelrc/gdbinitsubPath convention.Intended for a static OpenAI API key in
auth.json(generate withprintenv OPENAI_API_KEY | codex login --with-api-key). Since an API key is never refreshed, the read-only mount is sufficient. With no OS keyring in the container, the defaultcli_auth_credentials_store = autofalls back tofileon its own, so no extra config is required.