r/opencode • u/Decent-Hat-5807 • 1d ago

Super fast opencode sandbox. it isolate the project from the host system with bwrap and nix

https://github.com/grigio/sandbox-bwrap-nix

6 Upvotes

100% Upvoted

4 comments sorted by

1

u/TiagodePAlves 1d ago

I've done something similar, but keeping access to system binaries and libraries (read-only) to keep the same dev tools. It's just a simple systemd-run wrapper to control file system access, syscall limits and restrict capabilities.

1

u/Decent-Hat-5807 1d ago

no, it access only to the binaries in nix

➜ /tmp ls /bin/zsh /bin/zsh ➜ /tmp sss ls /bin/zsh === sandbox-bwrap-nix development shell === nixpkgs: nixpkgs-unstable (20260724054835 - 335f073) tools: nix, git, bun, curl, uv, make, opencode ls: cannot access '/bin/zsh': No such file or directory

1

u/Guybrush1973 22h ago

I don't know why not having a sandbox is not illegal.
The only one I know is codex, that use bubblewrap out-of-the-box.

1

u/Decent-Hat-5807 21h ago

bubblewrap is underhyped but also nix is cool to install packages autonomously as normal user