Browser login from a container
Codex's browser OAuth flow listens on 127.0.0.1:1455 inside the container, while the host browser redirects to http://localhost:1455/auth/callback. Docker port publishing cannot reach a service bound only to container loopback, so VibePod now detects vp run codex login, publishes the callback port on the host, and enables a small forwarder in the Codex image.
The Codex container forwards the published bridge port to its loopback-only login server. Device-code and API-key login modes skip this path because they do not need the browser callback.
Example commands
vp run codex login
# Device-code and API-key flows continue to avoid the callback forwarder:
vp run codex login --device-auth
vp run codex login --with-api-key