- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs
Runs OpenCode 2 with full permissions while containing its mistakes:
- egress filter: squid in a container per project; squid.conf is rendered
from layered egress.conf files (package, user, project, local) with
allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
(installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
credentials hidden; ssh keys via the host's ssh-agent; session bus
replaced by an xdg-dbus-proxy limited to notifications; no permission
prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
global config adds opencode-notifier and cc-safety-net
- README in English and Russian
k.denisov