k.denisov
64c222a084
Runs OpenCode 2 with full permissions while containing its mistakes: - egress filter: squid in a container per project; squid.conf is rendered from layered egress.conf files (package, user, project, local) with allow/block/connect rules and expect-pass/expect-block self-tests - netlock: nftables rejects direct egress for the opencode-sandbox group (installed once with sudo as a systemd unit) - bubblewrap: read-only host, writable project, worktrees and state; credentials hidden; ssh keys via the host's ssh-agent; session bus replaced by an xdg-dbus-proxy limited to notifications; no permission prompts (sudo and systemd-run denied); refuses to run unsandboxed - per-project state in ~/.local/share/opencode-sandbox/<name> - worktrees: `wt add|rm|list` with project hooks - skills mounted per project; the opencode-sandbox skill explains the environment to the agent - plugins as submodules: context-panel, skill-compact-resurrect; global config adds opencode-notifier and cc-safety-net - README in English and Russian
29 lines
1.2 KiB
Plaintext
29 lines
1.2 KiB
Plaintext
# opencode-sandbox settings for this project (bash). Commit this file; personal overrides
|
|
# go to local/sandbox.conf. All settings and defaults: `opencode-sandbox config`.
|
|
# OCSB_PROJECT_DIR is set when this file is read.
|
|
|
|
# OCSB_NAME=myproject # container/state name; default: directory name
|
|
# OCSB_WEB_PORT=4196 # web UI; OpenCode listens on +1. Different per project
|
|
# OCSB_EGRESS_PORT=3128 # egress filter. Different per project
|
|
|
|
# Writable for the agent besides the project and its worktrees (relative to the project)
|
|
# OCSB_RW=(../shared-fixtures)
|
|
# Hidden from the agent (relative to the project)
|
|
# OCSB_HIDE=(../secrets)
|
|
|
|
# Skills mounted for the agent: names of skill directories from the package's skills/
|
|
# or OCSB_SKILL_DIRS
|
|
# OCSB_SKILLS=(opencode-sandbox)
|
|
# OCSB_SKILL_DIRS=(~/skills)
|
|
|
|
# Tokens for MCP servers and the model provider: KEY=VALUE file, keep it out of git
|
|
# OCSB_ENV_FILE=~/.config/myproject/agent.env
|
|
# OCSB_KUBECONFIG=~/.kube/myproject-agent.yaml
|
|
# OCSB_ENV=(SOME_FLAG=1)
|
|
|
|
# Worktrees: <OCSB_WORKTREES_DIR>/<OCSB_WT_PREFIX><slug>
|
|
# OCSB_WORKTREES_DIR=../myproject-worktrees
|
|
# OCSB_WT_PREFIX=myproject-wt-
|
|
# OCSB_WT_BASE=main
|
|
# OCSB_WT_SLUG_REGEX='PROJ-([0-9]+)' # branch feature-PROJ-42-x → slug 42
|