Codex sandbox modes explained: read-only, workspace-write, danger-full-access
read-only lets Codex read files but not change them or use the network. workspace-write lets it edit files and run commands inside the workspace, with network off by default. danger-full-access removes the sandbox entirely. Set it with sandbox_mode in config.toml or --sandbox on the command line.
Stats from the 2026-10-20 snapshot of public GitHub configs (methodology). Behavior checked against the official docs linked below.
Config
# ~/.codex/config.toml or .codex/config.toml
sandbox_mode = "workspace-write"
approval_policy = "on-request"
[sandbox_workspace_write]
network_access = falseread-only
Good for reviewing code, answering questions about a repo, and CI jobs that only report. Codex asks before doing anything that needs more access (unless approval_policy is never).
workspace-write
The default for most repo work. Writes outside the workspace and network access need approval. Folders like .git and .codex stay read-only even inside the workspace.
danger-full-access
No sandbox. Combined with approval_policy = "never" it's the same as --yolo. Only use it inside a container or VM you can throw away.
What public configs do
Of 1,200 unique public Codex configs that set sandbox_mode or approval_policy, 216 (18%) use danger-full-access and 155 (12.9%) pair it with approval_policy = "never".
FAQ
How do I enable network in workspace-write?
Set network_access = true under [sandbox_workspace_write] in config.toml.
Which mode does --full-auto use?
workspace-write with on-request approvals.