From 816dec666916d617e7e0452912ad37005da29f26 Mon Sep 17 00:00:00 2001
From: virskl <andreas.burnickl@vector.com>
Date: Sun, 23 Aug 2026 19:44:48 +0200
Subject: [PATCH] Persist Codex login across container rebuilds

---
 .devcontainer/Dockerfile              |  5 +++++
 .devcontainer/README.md               | 14 ++++++++++----
 .devcontainer/linux/devcontainer.json |  1 +
 .devcontainer/wslg/devcontainer.json  |  3 ++-
 4 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 1401229e..e35cab3f 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -129,6 +129,11 @@ RUN python3 -m venv /opt/playwright && \
 # cannot write the ~1.5 GB of toolchain into it.
 RUN install -d -o vscode -g vscode -m 0755 /home/vscode/.platformio
 
+# Codex keeps its login and local configuration here. The devcontainer variants mount a
+# named volume over this path so those files survive a rebuild. Seed its ownership from
+# the image; otherwise a newly created Docker/Podman volume is owned by root.
+RUN install -d -o vscode -g vscode -m 0700 /home/vscode/.codex
+
 # GitHub's SSH host key, so that the first git operation in a fresh container verifies
 # against something rather than failing with "Host key verification failed" - which is
 # what it does today, because ~/.ssh belongs to the container and is empty after every
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
index 366c408f..e167e328 100644
--- a/.devcontainer/README.md
+++ b/.devcontainer/README.md
@@ -11,6 +11,13 @@ Choose the configuration matching the host. Keeping the WSLg mount in its own
 configuration prevents native Linux container startup from failing when
 `/mnt/wslg` does not exist.
 
+## Persistent Codex login
+
+Both configurations mount the named `wordclock-codex` volume at
+`/home/vscode/.codex`. This preserves the Codex login and local configuration
+when the development container is rebuilt. The volume contains credentials; do
+not share, export or remove it unless the saved login should be discarded.
+
 ## SSH agent on Linux
 
 The Linux variant mounts the host's `SSH_AUTH_SOCK` at the fixed path
@@ -185,10 +192,9 @@ be committed (internal base images, registry-hosted features, credentials). The
 Add such a directory to `.gitignore` to keep it local; `/.devcontainer/vector/`
 is already listed there.
 
-Anything that persists credentials belongs in such a variant rather than in the
-committed ones. Persisting a tool's login across rebuilds, for instance, takes a
-named volume plus one `chown`, because a volume whose target does not exist in
-the image is created owned by root:
+Persisting another tool's login across rebuilds takes a named volume plus one
+`chown`, because a volume whose target does not exist in the image is created
+owned by root:
 
 ```jsonc
 "mounts": [
diff --git a/.devcontainer/linux/devcontainer.json b/.devcontainer/linux/devcontainer.json
index e5f41653..de1cd8a8 100644
--- a/.devcontainer/linux/devcontainer.json
+++ b/.devcontainer/linux/devcontainer.json
@@ -27,6 +27,7 @@
     ],
     "mounts": [
         "source=/tmp/.X11-unix,target=/tmp/.X11-unix,type=bind",
+        "source=wordclock-codex,target=/home/vscode/.codex,type=volume",
         "source=${localEnv:SSH_AUTH_SOCK},target=/tmp/ssh-agent,type=bind"
     ]
 }
diff --git a/.devcontainer/wslg/devcontainer.json b/.devcontainer/wslg/devcontainer.json
index 13107b1e..af87acec 100644
--- a/.devcontainer/wslg/devcontainer.json
+++ b/.devcontainer/wslg/devcontainer.json
@@ -17,6 +17,7 @@
     },
     "mounts": [
         "source=/tmp/.X11-unix,target=/tmp/.X11-unix,type=bind",
-        "source=/mnt/wslg,target=/mnt/wslg,type=bind"
+        "source=/mnt/wslg,target=/mnt/wslg,type=bind",
+        "source=wordclock-codex,target=/home/vscode/.codex,type=volume"
     ]
 }