- no docker0 yet (dockerd is socket-activated and starts on first use): fall back to the
default gateway instead of exiting silently under pipefail
- an ERR trap in the main process prints file, line and command of an unhandled failure
- egress layers list returns success when the last layer is absent
- drop the stale OCSB_EGRESS_BASE from the settings list (broke `config`)
Runs OpenCode 2 with full permissions while containing its mistakes:
- egress filter: squid in a container per project; squid.conf is rendered
from layered egress.conf files (package, user, project, local) with
allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
(installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
credentials hidden; ssh keys via the host's ssh-agent; session bus
replaced by an xdg-dbus-proxy limited to notifications; no permission
prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
global config adds opencode-notifier and cc-safety-net
- README in English and Russian
k.denisov