Guide

Run ChatGPT commands in a Mac sandbox or Docker container

ChatGPT on the web cannot run commands on your Mac by itself. With TunnelGPT, you allow command execution for one project and choose where it runs: an isolated Linux container in Docker with no external network, or advanced native execution inside a macOS sandbox. ChatGPT then starts each command as a job and reads its status and output, and you decide whether its changes reach your project.

This guide covers how the two environments differ, how execution relates to file access, how to run a first low-risk command and when OpenAI's Codex sandbox or Docker's sandbox for the ChatGPT desktop app fits better. To connect a project folder first, see how to connect ChatGPT to local files.

Checked on 25 October 2026

We checked OpenAI's sandboxing documentation and Docker's ChatGPT sandbox integration page on 25 October 2026. Those pages carry no date stamps, and labels and availability can change with your account, plan and app version.

Linux container or native macOS?

In TunnelGPT, open Remote development for a project connection. The panel offers two environments, each with its own Allow switch and its own choice under It may run: Commands (an argument list run without a shell) or Shell scripts (run by /bin/sh, /bin/bash or, on the Mac, /bin/zsh).

Native jobs can read the toolchain folders the panel lists, write the cache folders it lists and read any extra folders you approve. They cannot read the rest of your home folder, your keychain, your SSH keys or TunnelGPT data. Before enabling it you tick I understand how native execution works on this Mac. The app states it plainly: Apple's sandbox is not a virtual machine. Native execution does not support Chromium.

Execution is a separate permission from file access

A project connection starts read-only. Editing files and running commands are two further steps. TunnelGPT's command and job tools need Allow writing turned on for the connection, and each environment also needs its own execution grant from the Remote development panel. In read-only mode, ChatGPT cannot start jobs, run commands or publish job changes: those tools answer LOCAL_MCP_WRITE_MODE_REQUIRED and run nothing. Turning on editing alone never lets ChatGPT run commands.

Private copy or direct mode

Under Where commands work, each environment has two workspace modes:

• Private copy (safer). The job works on a private copy of the current project files, which leaves out .env, credentials and secrets folders. Afterwards ChatGPT can list what changed and publish added or modified text files through the confirmed file tools. A file is written only if the project file still matches the version the job started from. Deletions, links and credential-shaped paths are reported, never published.
• Work directly in the project folder. Commands read and write the real project in place, with no snapshot, journal or receipts. You must acknowledge that commands can read and modify project files, including .env, credentials and nested secrets folders, that their contents may appear in replies to ChatGPT and that TunnelGPT cannot undo these changes. Keep the project under version control or backed up.

Step by step: a first low-risk command

You need TunnelGPT on a Mac with Apple Silicon, Docker 24 or later running and a project connection that already works in ChatGPT. The guided setup covers the OpenAI tunnel and restricted key. Use a small, disposable project for the first test.

1. Turn on Allow writing for the connection. Execution is not available on a read-only connection.
2. Open Remote development for that project.
3. Turn on Allow for Isolated Linux container (recommended) and tick only Commands under It may run.
4. Keep Private copy (safer) under Where commands work.
5. Leave Allow dependency download during Prepare off unless the project needs packages from its lockfile.
6. Choose Prepare, then Enable. Wait until the environment shows Ready.
7. Ask ChatGPT for a harmless command, such as printing a tool version.

Call execution_status. Then use run_command in linux-dev, mode command,
with argv ["python3", "--version"]. Poll get_job until the job finishes
and show me the output from tail_job. Do not change any files.

A version string and a SUCCEEDED state confirm the whole path. Next, try the project's own test command. Enable shell scripts, native execution or direct mode only when a task needs them.

Check a job's result without starting it again

Every command becomes a job with an identifier. A chat response can end, or the connection can drop, while the job on your Mac keeps running. Ask ChatGPT to check the job instead of launching the same work again. These are the TunnelGPT tools it uses:

• execution_status lists the environments you enabled, their workspace mode, network and readiness. It never runs anything.
• run_command starts one command or shell script and returns a job ID at once. Repeating the same idempotency key after a lost response returns the same job, not a second run.
• get_job and list_jobs report the state: SUCCEEDED, FAILED, CANCELLED, INTERRUPTED or REFUSED. A slow or silent job is still running.
• tail_job pages through the merged output; job_output reads stdout or stderr alone.
• job_changes, job_read_file and job_publish_changes inspect and publish a private copy's changes.
• cancel_job is the only way to stop a healthy job. Slowness, silence or a lost connection never cancel it.
• start_job runs one of six fixed npm aliases, such as npm-test or npm-lint, with no shell and no arguments.

Network and data boundaries

• Linux jobs run offline. They start with Docker's --network none, so only loopback works, and package managers are set to offline mode.
• Dependency download is separate. If you allow it, only the preparation step gets network, and only fixed preparers run: cargo fetch --locked, npm ci --ignore-scripts and wheel-only pip install. Only lockfiles and manifests are copied for that step.
• Native jobs cannot reach other hosts. Outbound traffic is limited to loopback and host names do not resolve. A service a job starts can still accept connections from your LAN, so do not run one unless you intend that exposure.
• No credentials are passed in. TunnelGPT gives commands no keys, tokens or data of its own.
• Resources are capped. The panel shows the CPU, memory and process limits for each environment.
• What ChatGPT reads, OpenAI receives. Your files stay on the Mac, but command output, logs and file contents that ChatGPT requests travel to OpenAI as part of the conversation. This is not offline AI. See our privacy policy.

None of this makes execution universally safe. A command you approve can still do anything the environment allows: delete files in a direct project, fill a disk or run code from a dependency you prepared. Review the grant before enabling it, and turn it off when the task is done.

When Codex's sandbox or Docker's integration fits better

Docker's page notes that ChatGPT controls Codex permissions separately from the Docker Sandbox. If you want to bring your own MCP servers to ChatGPT chat instead of commands, see how to use local MCP servers with ChatGPT.

Troubleshooting

ChatGPT says the write mode is required. The connection is read-only. Turn on Allow writing for that connection in TunnelGPT and try again.

The environment is not Ready. For Linux, start Docker and choose Prepare. For the Mac, choose Check toolchains and repair any tool the panel flags. If the panel says something changed since you enabled it, review the settings and choose Update.

A build fails because a package cannot download. Linux jobs are offline by design. Allow dependency download during Prepare, then ask ChatGPT to call prepare_environment before running the build.

A long script is refused. The request and the script have size limits. Ask ChatGPT to write the script to a project file and run that file instead.

Is TunnelGPT an OpenAI product?

No. TunnelGPT is independent software, not affiliated with OpenAI. It costs $9.97 USD one-time for the Version 1 Perpetual License, after 3 free days: 72 consecutive hours from your first successful connection. See pricing.

Next steps

• Connect ChatGPT to a local project folder
• Do the one-time setup
• See the price and the license

Sources

• OpenAI: Sandboxing
• Docker: ChatGPT integration for Docker Sandboxes
• OpenAI: Secure MCP Tunnels
• TunnelGPT privacy policy