k.denisov
64c222a084
Runs OpenCode 2 with full permissions while containing its mistakes: - egress filter: squid in a container per project; squid.conf is rendered from layered egress.conf files (package, user, project, local) with allow/block/connect rules and expect-pass/expect-block self-tests - netlock: nftables rejects direct egress for the opencode-sandbox group (installed once with sudo as a systemd unit) - bubblewrap: read-only host, writable project, worktrees and state; credentials hidden; ssh keys via the host's ssh-agent; session bus replaced by an xdg-dbus-proxy limited to notifications; no permission prompts (sudo and systemd-run denied); refuses to run unsandboxed - per-project state in ~/.local/share/opencode-sandbox/<name> - worktrees: `wt add|rm|list` with project hooks - skills mounted per project; the opencode-sandbox skill explains the environment to the agent - plugins as submodules: context-panel, skill-compact-resurrect; global config adds opencode-notifier and cc-safety-net - README in English and Russian
20 lines
900 B
Plaintext
20 lines
900 B
Plaintext
# Network rules for this project, on top of the package defaults. Commit this file;
|
|
# personal or secret rules go to local/egress.conf.
|
|
#
|
|
# Policy: everything is allowed except what is blocked; private networks, names without a
|
|
# dot and ports other than 80/443 are always blocked unless allowed here.
|
|
#
|
|
# allow <domain>... .domain = the domain and all subdomains
|
|
# allow-regex <regex>...
|
|
# block <domain>...
|
|
# block-regex <regex>...
|
|
# connect <host:port>... tunnel to a non-443 port or an internal address
|
|
# expect-block <url> self-test (opencode-sandbox egress verify)
|
|
# expect-pass <url>
|
|
#
|
|
# Example: allow internal services but keep production out of reach
|
|
# allow git.example.internal ci.example.internal
|
|
# block .example.internal
|
|
# connect git.example.internal:2222 # git over SSH
|
|
# expect-block https://prod.example.internal/
|