Lab for local hosting with Docker
Install Docker Desktop and have Codex serve a page from a container on your own laptop.
You can ask Codex to run a small web page inside a container on your laptop, and then stop it.
You can have Codex write a Dockerfile and a compose file, start a container that serves a page on your laptop, and stop and remove it afterwards.
You can have an agent define, run and tear down a single-container service on localhost, and you can say which steps need network approval and why.
What you will make
You will run a small web page from a container on your own laptop.
A container is a sealed box that holds a program and all that it needs. Docker is the tool that runs these boxes.
Codex writes the setup files. You open the page in your browser. Then Codex stops the container and removes it.
A container packages a program with what it needs to run. Docker is the tool that builds and runs containers. In this lab, Codex writes two files: a Dockerfile that starts from the nginx:alpine web server image, and a compose file that maps port 8080 on your laptop to the web server.
You then open the page at http://localhost:8080. The page comes from your own laptop, not from a remote server. When you finish, Codex stops the container and removes it.
Codex asks before it runs any Docker command and before it pulls the image, because pulling an image needs the internet.
The lab defines a one-container service. The Dockerfile starts from nginx:alpine, and the compose file publishes host port 8080 to the web server's own port (8080:80). The service serves a static page from docker/site/ on localhost, and only the image pull reaches the internet for the service. Codex still sends the file content it reads to the model.
Network access is off by default in Codex. Pulling the image is therefore an approval event, as is each docker command. Treat both as a chance to read what runs before it runs.
Teardown is part of the task. Stopping and removing the container leaves the laptop in its starting state, apart from the cached image.
| File | What it holds |
|---|---|
docker/site/index.html | A one-page site to serve from a container |
Install Docker Desktop
Check the rules, then install
Ask your IT team if you may install Docker Desktop on this laptop. Read Docker's licence terms for work use first.
Then download and install Docker Desktop from the Docker website. Choose the WSL2 option (a Windows feature that runs Linux) when the installer asks.
Before you install, check your employer's policy and Docker's licence terms for work use. If you are not sure, ask IT.
Then install Docker Desktop from the Docker website. Choose the WSL2 option when the installer asks.
Before you install, check your employer's policy and Docker's licence terms for work use. Docker Desktop on Windows runs its engine on WSL2 in this setup. A container can reach host files only when you mount them.
Install Docker Desktop from the Docker website and choose the WSL2 option.
Restart and start Docker
Restart your laptop when the installer asks. Then open Docker Desktop.
Wait until Docker Desktop says it is running. Then go back to Codex.
Restart your laptop when the installer asks. Open Docker Desktop and wait until it reports that it is running. Codex cannot start a container until Docker is up.
Restart when the installer asks, open Docker Desktop and wait until the engine is running. If the later Docker commands fail with a connection error, the engine is not up yet. Do not ask Codex to work around it.
Serve the page
Send the brief and read the plan
Open Codex with the
CodexWorkfolder. Check that the mode says Ask for approval. Start a new thread.Copy the brief below and send it. Read the plan. Look for the port number.
Open Codex with
CodexWorkas the project folder, check that the mode says Ask for approval and start a new thread. Send the brief below.Read the plan. It should name the port, say that Codex will ask before each Docker command, and say that Codex does not change
docker/site.Start a new thread with Ask for approval and send the brief. In the plan, check the port mapping, the build context, the read-only treatment of
docker/siteand the teardown step.Approve each Docker command
Reply: Approved. Go ahead. Codex writes the files, then asks before it runs Docker.
Read each command. Approve it if it matches the plan. Codex also asks before it downloads the web server image, a packaged copy of the web server program.
Reply: Approved. Go ahead. Codex writes the two files, then asks before it runs
docker compose. It asks again before it pulls the image, because that needs the internet. Read each command and approve it if it matches the plan.Reply: Approved. Go ahead. Expect an approval for the file writes, one for the image pull and one for
docker compose up. Read each command: it should publish only port 8080 and mount nothing beyonddocker/site.New thread
- Local web page
Approved. Go ahead.
I wrote the Dockerfile and the compose file in outputs/docker. Next I start the container. Docker pulls the web server image the first time.
Codex wants to run
ApproveDeclineAsk Codex to do something
Codex asks before it starts the container. Read the command first. Open the page
Open your browser. Go to http://localhost:8080.
You should see a page that says it is served from a container.
Open your browser and go to http://localhost:8080. The page says it is served from a container. If it does not load, ask Codex to check whether the container is running.
Open http://localhost:8080 in your browser. If the page does not load, ask Codex for the container status and the log before you change anything else.
This page is served from a container
This page runs in an nginx container on your laptop. No remote server serves it.
The page comes from the container on your laptop. Stop and remove the container
Tell Codex to stop the container and remove it. Approve the command.
Reload the page in your browser. It should not load now.
Send the stop prompt below. Codex asks before it runs
docker compose down. Approve it, then reload the page. It should no longer load.Send the stop prompt. Approve
docker compose down, reload the page to confirm that it fails, and ask Codex to confirm that no container is left running.
Goal: Serve the page in docker/site/ from a container on this laptop. Inputs: docker/site/index.html Output: outputs/docker/Dockerfile that uses nginx:alpine, and outputs/docker/compose.yaml that maps port 8080 to the web server. Start the container. Constraints: Do not change any source file. Write only in outputs/. Ask me before you run any docker command and before you pull the image. Ask before you install anything. Done when: http://localhost:8080 shows the page. How to check: Show the container status and the command that you used. Make a plan first. Do not create any file until I approve the plan.
Stop the container and remove it. Ask me before you run the command. Do not change any source file. Then confirm that no container from this lab is still running.
Answer key
Open each question below. Compare the answer with your own result.
Open each question below and compare the answer with your own result.
Compare each answer with your own run. The values come from the starter pack, so a mismatch points to a defect in the output.
Check yourself
Which address shows the page, and what does the page say?
http://localhost:8080. The page says that it is served from a container.
http://localhost:8080. The page heading says that it is served from a container on your laptop.
http://localhost:8080. The page is the static file in docker/site/, so the heading names a container and not a remote server.
Why does Codex ask before it pulls the image?
Pulling the image needs the internet. Codex cannot use the internet by default. Codex must ask you first.
Pulling an image needs the internet, and network access is off by default. Codex asks, and you read the command before you approve it.
An image pull is a network action, and network access is off by default. It is also the moment when remote content enters your laptop, so read what Codex pulls and from where.
What does the stop step do?
It stops the container and removes it. The page then stops loading.
It stops the container and removes it, so port 8080 is released and the page stops loading.
It tears the service down so that port 8080 is released and no container is left running. The downloaded image stays cached unless you remove it.
Key terms
- Docker
A tool that runs programs in sealed boxes called containers.
A tool that builds and runs containers.
A container platform. Docker Desktop on Windows runs the engine on WSL2 in this lab.
- Container
A sealed box that holds a program and all that it needs to run.
A packaged program with its files and settings. It runs the same way on any laptop that has Docker.
An isolated process started from an image, with its own file system view and network settings, sharing the host kernel.
Go further
Ask Codex to change the words on the page and restart the container. Check that the new words show.
Do this only in a copy of the page in outputs, not in the starter pack.
Ask Codex to copy the page to outputs, change the text, and serve the copy. Then ask it to write a short note that explains each line of the compose file.
You can also ask Codex to use $skill-creator to make a serve-local skill that runs this routine for any folder of static files.
Package the routine as a skill with $skill-creator, with a script that builds, starts, probes the URL and tears down. For scripted runs, codex exec can drive the same brief non-interactively, and the probe gives it an executable check.
OtterBlock is not affiliated with OpenAI. Codex and ChatGPT are OpenAI products.