From 13abb2ece02c7a04fa44f2b1ec21260193c966f4 Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 23 Jul 2026 03:34:52 +0200 Subject: [PATCH] fix(docker): install codex CLI via npm, not the CDN-denied installer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The chatgpt.com/codex/install.sh installer returns 'resource is denied' to non-browser clients in CI, breaking the agent-codex image build. Switch to npm install -g @openai/codex@: the package has no postinstall network fetch (verified) — its native binary rides an optionalDependency served from the public npm registry, and node is already in the base image. Verified locally: install succeeds, codex --version runs. --- docker/agent-codex.Dockerfile | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/docker/agent-codex.Dockerfile b/docker/agent-codex.Dockerfile index 5438d0f6..60fba207 100644 --- a/docker/agent-codex.Dockerfile +++ b/docker/agent-codex.Dockerfile @@ -19,18 +19,17 @@ FROM roboco-agent-base USER root -# Install the official codex CLI for the agent user. Pinned — untrusted model -# output runs under it, so bump the version deliberately, never float. Download -# the installer to a file first (a `curl | bash` pipe hides a curl failure as a -# silent no-op) and verify the binary installed AND runs, so a broken install -# fails the build here, not at spawn. (curl/bash from the base.) +# Install the official codex CLI globally via npm. Pinned — untrusted model +# output runs under it, so bump the version deliberately, never float. The +# npm route (not chatgpt.com/codex/install.sh, which the CDN denies to +# non-browser clients) has no postinstall network fetch: the native binary +# rides an optionalDependency (@openai/codex-linux-x64) served from the +# public npm registry. Global install symlinks `codex` onto PATH for the +# agent user; verify it runs so a broken install fails the build, not spawn. ARG CODEX_CLI_VERSION=0.145.0 -RUN su agent -s /bin/bash -c "set -euo pipefail; export HOME=/home/agent; \ - curl -fsSL https://chatgpt.com/codex/install.sh -o /tmp/codex-install.sh; \ - bash /tmp/codex-install.sh ${CODEX_CLI_VERSION}; \ - test -x /home/agent/.codex/bin/codex || command -v codex; \ - codex --version" \ - && rm -rf /tmp/* +RUN npm install -g @openai/codex@${CODEX_CLI_VERSION} \ + && command -v codex \ + && codex --version # Entrypoint: render ~/.codex/config.toml + execpolicy rules + the per-role # sandbox flag, then run codex headless (overrides the base image's `claude`