3 hours ago
Hello Railway team,
I’m evaluating Railway for scheduled Codex tasks that must continue running when my personal computer is turned off.
Could you clarify which Railway product—Services, Sandboxes, or Cloud Agents—supports the following requirements?
Codex runs as a non-root user without sudo access.
Codex’s native Linux sandbox and approval mechanism remain enabled. I do not want to use privileged mode, CAP_SYS_ADMIN, danger-full-access, or disable security controls.
Agent tools can access only the current task’s input and output directories, not other projects, Codex sign-in credentials, or Railway/GitHub management credentials.
The Codex application can connect to its model provider, while agent-executed tools have outbound network access disabled by default.
Previous test
Using Codex 0.163.0-alpha.10.2 in a Railway Sandbox, a configuration with an additional outer isolation layer failed when starting the inner sandbox:
bwrap: setting up uid map: Operation not permitted
This establishes only that this particular configuration failed. I am not assuming Railway generally cannot run Codex, and I do not want to repeat the same failed setup.
Questions
Do you have a known working configuration that runs Codex directly with its native sandbox enabled, without an additional custom outer sandbox? Please specify the Railway product, OS image/kernel, Codex and bubblewrap versions, execution user, and required settings.
Which user, mount, and network namespace operations, UID/GID mappings, and seccomp operations are supported or restricted?
Cloud Agents documentation mentions authenticated Railway and GitHub CLIs. Can I provision a clean environment without those management credentials, without copying my local Codex auth.json, and without automatically importing MCP configurations or Skills? What is the supported procedure?
Has the configuration been verified to enforce restrictions for both shell commands and native file tools? If not, please distinguish platform capability from untested Codex behavior.
Which product supports scheduled execution independently of Desktop or SSH connections? How would sleep policies, idle timeouts, or Priority Boarding limitations affect this?
I understand that task authorization, approval handling, and result validation remain application responsibilities. I’m asking for documented platform capabilities and known working configurations, rather than a general statement that Codex is supported.
If a different Codex version is required, please identify it and explain why. This is an information request only; please do not create or modify resources, transfer credentials, or initiate billable actions.
Thank you.
1 Replies
3 hours ago
We don't have a known working configuration that runs Codex with its native bubblewrap sandbox enabled on Railway. In Sandboxes and Cloud Agents, workloads can't create unprivileged user namespaces, so bwrap: setting up uid map: Operation not permitted is what you'll get on those products with any Codex or bubblewrap version, with or without an outer isolation layer. We don't have a verified answer for user namespace support on regular Services, so we can't recommend one product as meeting your sandbox requirements, and nothing has been tested for shell commands versus native file tools.
On networking, every sandbox has outbound internet access. The default ISOLATED mode only keeps it off your environment's private network, so blocking egress for agent tools while Codex reaches its model provider would have to be enforced inside the workload.
On credentials, a Cloud Agent can be created without a GitHub token. Sandboxes only receive the environment variables you pass at creation, so nothing like your local Codex auth.json is copied in unless you put it there.
On scheduling, Sandboxes and Cloud Agents run on demand and have no built-in scheduler. A sandbox is destroyed after its idle timeout, and background processes outside an active session don't keep it alive. On Trial and Free the timeout is 1 to 5 minutes and can't be disabled. On Hobby and Pro it's up to 120 minutes, or you can disable it with idleTimeoutMinutes: 0. See Sandboxes for the details.
Status changed to Awaiting User Response Railway • about 3 hours ago