The host's /usr/bin/codex is a symlink to the codex.js entrypoint inside
the package directory; bind-mounting it directly resolves to the file
content but breaks codex's import.meta.url-based module resolution. Add
the symlink at build time so a /usr/lib/node_modules/@openai/codex bind
mount is enough to make codex usable in the container.
- Add a root .dockerignore to reduce build context and exclude local runtime state
- Add a multi-stage Dockerfile that builds the workspace, runs as non-root, and includes health checks
- Document Docker build/run usage, env vars, persistence, and quick-start commands in README and docs/docker.md
- Add Docker configuration tests in packages/cli/src/docker.test.ts to validate required image and docs expectations
