Cloudflare Containers are now usable as the execution host for the OpenAI Agents API, letting each Codex session run inside a dedicated, self‑hosted container. This shifts the runtime boundary from a purely OpenAI‑managed environment to a Cloudflare‑controlled one, while OpenAI continues to handle session orchestration, context compaction, and recovery.
Architectural Shift
The new pattern introduces a Cloudflare Worker that spawns a separate Container for every Codex session. The Worker maintains the container’s lifecycle: it keeps the container alive while work is in progress, reconnects on subsequent inputs, and automatically shuts the container down after a period of inactivity. The OpenAI Agents API remains the entry point, but the actual code execution now occurs inside the Cloudflare Container.
Implementation Guidance
Developers can start with the open‑source Workers template located in the cloudflare/sandbox-sdk/openai/agents-api repository. The template demonstrates how to:
- Instantiate a Container per session.
- Maintain an active connection for follow‑up prompts.
- Detect idle state and trigger automatic shutdown.
Practitioners can extend the container definition to restrict network access, mount data sources, or integrate with other Cloudflare services such as KV storage or R2. Because the container runs under the developer’s control, any additional tooling or data‑access policies must be explicitly added.
Operational Considerations
Running Codex in self‑hosted containers introduces new operational signals to monitor:
- Container start‑up latency, which adds to the overall request time.
- Resource consumption per session, especially if many concurrent containers are active.
- Idle‑shutdown thresholds, which affect cost and availability.
Operators should instrument the Worker to emit metrics on container lifecycle events and set alerts for unexpected spikes in container count or prolonged idle periods.
Security Implications
Isolation is now provided by the Cloudflare Container runtime rather than by OpenAI’s internal sandbox. This gives engineers the ability to enforce controlled data and network access inside the container, but also places responsibility on them to configure those controls correctly. Misconfiguration could expose internal resources or allow unintended outbound traffic.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Adopting the Cloudflare Container model lets you keep execution of Codex prompts within your own trust boundary while still leveraging OpenAI’s session management. Evaluate the template, define the minimal network and data permissions required for your use case, and instrument lifecycle metrics to ensure the new containers behave predictably at scale.
