k.denisov
64c222a084
Runs OpenCode 2 with full permissions while containing its mistakes: - egress filter: squid in a container per project; squid.conf is rendered from layered egress.conf files (package, user, project, local) with allow/block/connect rules and expect-pass/expect-block self-tests - netlock: nftables rejects direct egress for the opencode-sandbox group (installed once with sudo as a systemd unit) - bubblewrap: read-only host, writable project, worktrees and state; credentials hidden; ssh keys via the host's ssh-agent; session bus replaced by an xdg-dbus-proxy limited to notifications; no permission prompts (sudo and systemd-run denied); refuses to run unsandboxed - per-project state in ~/.local/share/opencode-sandbox/<name> - worktrees: `wt add|rm|list` with project hooks - skills mounted per project; the opencode-sandbox skill explains the environment to the agent - plugins as submodules: context-panel, skill-compact-resurrect; global config adds opencode-notifier and cc-safety-net - README in English and Russian
21 lines
1003 B
JSON
21 lines
1003 B
JSON
// Global OpenCode 2 config used by opencode-sandbox for every project. Override it with
|
|
// ~/.config/opencode-sandbox/opencode.jsonc or OCSB_OPENCODE_CONFIG. Project settings
|
|
// (model, MCP servers, project plugins) stay in the project's opencode.jsonc.
|
|
{
|
|
"$schema": "https://opencode.ai/config.json",
|
|
"share": "disabled",
|
|
"update": "disable",
|
|
|
|
// Plugin lists from the global and project configs are merged. Versions are pinned: a
|
|
// plugin is code inside the OpenCode process with all of its rights.
|
|
"plugins": [
|
|
// desktop notifications (in the sandbox: through a D-Bus proxy limited to notifications)
|
|
"@mohak34/opencode-notifier@1.1.0",
|
|
// parses commands before tools run and blocks destructive ones (git reset --hard,
|
|
// clean -f, checkout --, branch -D, rm -rf on dangerous paths, curl | bash) and secret
|
|
// access (~/.ssh, .env). Project exceptions: <project>/.cc-safety-net/policy.json.
|
|
// Does not inspect docker or kubectl
|
|
"cc-safety-net@2.7.0"
|
|
]
|
|
}
|