By the Motive Force, may thy augmetics never falter.

— Skitarii Marshal Neius Lal, Imperfect Engines (short story) (excerpt)

The filesystem behind /tmp was almost full. Codex kept leaving temporary clones, build staging, and screenshots there, and the files were accumulating.

On my machine, /tmp shared a small 32 GB root filesystem. My home partition had much more room. Giving Codex a directory there would move its temporary work off root. Scheduled cleanup would stop old files from accumulating.

A cyclist puts a stick into his own wheel, then falls off.

The agent and I had different definitions of temporary.

The fix had three parts: give Codex a folder under my home directory, let its tools use that folder, and schedule cleanup. Here’s the setup I used with Codex CLI 0.153.4 and systemd 249 on Linux.

A folder for temporary work

I chose ~/.cache/codex-tmp. These commands check the available space and create it, along with the configuration directories we’ll use below:

df -h /tmp "$HOME"
install -d -m 700 "$HOME/.cache/codex-tmp"
mkdir -p "$HOME/.config/user-tmpfiles.d" "$HOME/.config/systemd/user"

The next step is in ~/.codex/config.toml. The environment variables tell tools where to create temporary files. The permission profile gives Codex access to that location.

Merge the following into your existing configuration, replacing /home/YOU with your home path. The first three settings belong before any table headers. If you already use a named profile, add the directory permission to that profile.

default_permissions = "hemant"
approval_policy = "on-request"
approvals_reviewer = "auto_review"

[shell_environment_policy.set]
TMPDIR = "/home/YOU/.cache/codex-tmp"
TMP = "/home/YOU/.cache/codex-tmp"
TEMP = "/home/YOU/.cache/codex-tmp"

[permissions.hemant]
extends = ":workspace"

[permissions.hemant.filesystem]
"/home/YOU/.cache/codex-tmp" = "write"

I named my profile hemant, so that’s what the permissions picker displays. Approve for me still works: approvals_reviewer = "auto_review" sends eligible approval requests to the reviewer. The profile name simply identifies my filesystem permissions. This uses on-request; setting approval policy to never would prevent those requests. OpenAI’s documentation explains how the reviewer fits in.

That permission setup is what let me step away from the constant approval prompts. I wrote about it here.

After restarting Codex, ask it to run printenv TMPDIR TMP TEMP and mktemp. The paths should point to the new folder. Remove the test file afterwards. Codex documents the environment setting here.

These variables work for tools that respect them. A command with /tmp/file written directly into it still uses /tmp.

Clean up old files

I use systemd’s timestamp-based cleanup. Save this policy in ~/.config/user-tmpfiles.d/codex-tmp.conf:

d %h/.cache/codex-tmp 0700 - - 2d -

The 2d gives files a 48-hour age threshold. My own setting is 12h, but 48 hours leaves more room between sessions. If you regularly resume work after a weekend, choose a longer interval.

This folder is for disposable files. Cleanup uses timestamps, so it cannot know whether an agent plans to use a file again. Repositories, resumable worktrees, and important outputs belong elsewhere. The policy controls age, not folder size. systemd’s reference covers the timestamp rules.

Run cleanup on a schedule

Two small files connect that policy to a timer. The service runs cleanup; the timer runs the service every six hours.

Save the service as ~/.config/systemd/user/codex-tmp-clean.service:

[Unit]
Description=Clean stale Codex scratch files

[Service]
Type=oneshot
ExecStart=/usr/bin/systemd-tmpfiles --user --clean %h/.config/user-tmpfiles.d/codex-tmp.conf

Save the timer as ~/.config/systemd/user/codex-tmp-clean.timer:

[Unit]
Description=Clean Codex scratch files every six hours

[Timer]
OnCalendar=*-*-* 00/6:00:00
Persistent=true
RandomizedDelaySec=5min

[Install]
WantedBy=timers.target

Persistent=true catches a missed run when the timer becomes active again. The five-minute random delay spreads out startup work. The timer runs through your user manager; it doesn’t keep the laptop awake. (Timer settings)

Enable it and check the next scheduled run:

systemctl --user daemon-reload
systemctl --user enable --now codex-tmp-clean.timer
systemctl --user list-timers codex-tmp-clean.timer

After a run, journalctl --user -u codex-tmp-clean.service shows the result and any errors.

The agent’s habit of using scripts for tiny tasks deserves its own discussion, which is here. For the files those sessions leave behind, this gives me a dedicated place and a regular cleanup schedule.