Michael Bolin 61805a832d fix: do not grant "node" user sudo access when using run_in_container.sh (#627) ... This exploration came out of my review of https://github.com/openai/codex/pull/414. `run_in_container.sh` runs Codex in a Docker container like so: bd1c3deed9/codex-cli/scripts/run_in_container.sh (L51-L58) But then runs `init_firewall.sh` to set up the firewall to restrict network access. Previously, we did this by adding `/usr/local/bin/init_firewall.sh` to the container and adding a special rule in `/etc/sudoers.d` so the unprivileged user (`node`) could run the privileged `init_firewall.sh` script to open up the firewall for `api.openai.com`: 31d0d7a305/codex-cli/Dockerfile (L51-L56) Though I believe this is unnecessary, as we can use `docker exec --user root` from _outside_ the container to run `/usr/local/bin/init_firewall.sh` as `root` without adding a special case in `/etc/sudoers.d`. This appears to work as expected, as I tested it by doing the following: ``` ./codex-cli/scripts/build_container.sh ./codex-cli/scripts/run_in_container.sh 'what is the output of `curl https://www.openai.com`' ``` This was a bit funny because in some of my runs, Codex wasn't convinced it had network access, so I had to convince it to try the `curl` request:  As you can see, when it ran `curl -s https\://www.openai.com`, it a connection failure, so the network policy appears to be working as intended. Note this PR also removes `sudo` from the `apt-get install` list in the `Dockerfile`.		2025-04-24 14:25:02 -07:00
..
build_container.sh	(fix) update Docker container scripts (#47)	2025-04-16 12:02:41 -07:00
init_firewall.sh	Initial commit	2025-04-16 12:56:08 -04:00
run_in_container.sh	fix: do not grant "node" user sudo access when using run_in_container.sh (#627)	2025-04-24 14:25:02 -07:00