Codex CLI's read-only, workspace-write, and danger-full-access modes are policy settings. The actual isolation is enforced by platform backends. This article connects the source-level view with the common macOS and Linux sandbox primitives.

Synchronizing container directories alone is not a complete backup. Databases need consistent logical exports, while configuration, certificates, and attachments are good candidates for incremental rsync synchronization.

This migration mainly accomplished two things: first fixing the Docker port mapping failure on Debian 12, then migrating new-api from SQLite to MySQL. There were quite a few pitfalls along the way, especially iptables/nftables compatibility and SQLite to MySQL syntax differences.

When installing Docker applications via 1Panel on a Debian 12 server, I encountered a very typical problem: containers could be created successfully, but port mapping failed at startup. On the surface it looks like a Docker error, but the actual cause is iptables backend and Docker chain incompatibility.