Windows Codex isolated service launch blocked by policy

Problem

In the Codex desktop app on Windows, a request to start isolated Docker services for pre-release testing was rejected with:

exec_command failed: CreateProcess … rejected: blocked by policy

The rejection occurred before the command executed. No browser automation was involved.

Test environment

• Web binding: 127.0.0.1:23015 only
• Dedicated Docker network with Internal=true
• Isolated PostgreSQL database and dedicated storage
• No production database connection or production directory mounts
• Existing verified image; no rebuild

The launch remained blocked after the isolation configuration was revised. Further attempts have stopped. The exact blocking rule is unknown.

Expected behavior

Allow the isolated test if permitted, or provide an actionable explanation of the restriction and a supported recovery path.

Environment

• Windows desktop
• Codex desktop app; exact version not yet collected
• Incident date: September 11, 2026, Beijing time (UTC+8)

Feedback ID

01a05c87-7673-73c0-a81c-69d4cdff6b0a

Please help identify the rejecting component and determine whether this is a false positive. I am not requesting a bypass of safety controls.

Start by collecting the exact Codex desktop version and reviewing the failure details associated with feedback ID 01a05c87-7673-73c0-a81c-69d4cdff6b0a. Reproduce the isolated Windows launch using the stated Docker, network, database, and storage constraints; done means identifying the rejecting component and documenting either supported behavior or an actionable recovery path.