Deploy and Host a Codex Cloud Box on Railway

This template gives you an always-on Ubuntu 24.04 workstation with the OpenAI Codex CLI pre-installed. Open your Railway domain for a terminal in the browser, or SSH in through Railway's TCP proxy. Your home directory lives on a volume, so repos, your Codex login, GitHub auth and dotfiles survive every redeploy.

About Hosting a Codex Cloud Box

One service, one volume. The image ships codex, git, gh, Node 22, Python 3 + uv, tmux, ripgrep, jq, vim, build tools and an OpenSSH server. A ttyd web terminal (basic-auth gated) and sshd (password or key) both drop you into the same tmux session, so you can start a long Codex run from your laptop and pick it up from your phone. SSH host keys are stored on the volume, so your client never sees a "host key changed" warning after a redeploy.

Common Use Cases

Run Codex 24/7 on a task without keeping your laptop open
Code from an iPad, Chromebook or phone: the browser terminal needs no SSH client
Use your ChatGPT Plus, Pro or Business plan from a box that is always on
Keep a persistent workspace for side projects that is reachable from anywhere

Dependencies for Codex Cloud Box Hosting

None. Single service, no database.

Deployment Dependencies

Codex CLI and its docs
ttyd web terminal
GitHub CLI

Implementation Details

First use: open your Railway domain and log in with WEB_USER and the generated WEB_PASSWORD (service Variables tab). Then sign Codex in, one of two ways:

ChatGPT plan: run codex login --device-auth. It prints a URL and a one-time code: open the URL on any device, sign in to ChatGPT and enter the code. The login is saved under ~/.codex on the volume.
API key: set OPENAI_API_KEY as a service variable. The box saves it as Codex's login on every boot, so a changed key takes effect after a redeploy.

Then cd ~/src, clone a repo and run codex.

SSH: Railway creates a TCP proxy for port 22 on deploy. Copy the host and port from Settings → Networking and run ssh root@‹host› -p ‹port› with ROOT_PASSWORD, or add your public key to AUTHORIZED_KEYS and clear ROOT_PASSWORD for key-only login.

Handy commands inside the box:

cx starts Codex inside a detachable tmux session named codex; tmux attach -t codex resumes it
gh auth login or set GH_TOKEN to push to GitHub
codex doctor checks the install, config, login and sandbox

Notes and limits:

You are root. Anything you install outside /root disappears on redeploy; anything under /root stays. New Codex versions arrive as template updates.
0.5 GB of RAM runs Codex itself; give the service 1 GB or more if Codex builds Node or Python projects.
Codex's own command sandbox (bubblewrap) cannot start in Railway's container, so the box writes sandbox_mode = "danger-full-access" to ~/.codex/config.toml on first boot: Codex runs commands directly, and the container is the boundary. Edit that file to change it; it is never overwritten.
There is no Docker daemon inside the box.
The web terminal password is the whole security model for a root shell. Keep it strong and do not share the URL.

Why Deploy a Codex Cloud Box on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying a Codex cloud box on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.