- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs
Off by default. With OCSB_DISPLAY=1 the sandbox gets only the Wayland socket and /dev/dri: the agent's windows (e.g. a Playwright browser) appear on the desktop, but a Wayland client cannot read other windows or inject input into them. X11 and the X cookie are never passed in.
- /tmp: the agent gets its own (<state>/tmp, files older than 7 days are
removed on start) — the host's /tmp holds sockets that lead out of the
sandbox (tmux, X11, browsers' singleton sockets, other tools).
OCSB_TMP=shared keeps the old behaviour. /tmp is mounted before the
project and state binds so they stay visible if they live under /tmp
- DISPLAY, WAYLAND_DISPLAY, XAUTHORITY are empty in the sandbox and
~/.Xauthority is hidden; browsers must run headless
- GIT_SSH_COMMAND uses -F ~/.ssh/config: in the user namespace root-owned
system ssh configs look owned by nobody and ssh refuses them
- netlock self-test checks that the proxy opens the tunnel, not that a
remote site answers; failed self-tests now say so instead of exiting
silently
- doctor: no false error for opencode outside a project
- skill and READMEs: worktrees only for code changes, private /tmp,
headless browsers, troubleshooting entries
Runs OpenCode 2 with full permissions while containing its mistakes:
- egress filter: squid in a container per project; squid.conf is rendered
from layered egress.conf files (package, user, project, local) with
allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
(installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
credentials hidden; ssh keys via the host's ssh-agent; session bus
replaced by an xdg-dbus-proxy limited to notifications; no permission
prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
global config adds opencode-notifier and cc-safety-net
- README in English and Russian
k.denisov