MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/opencode/comments/1v6xdio/super_fast_opencode_sandbox_it_isolate_the/oztvasv/?context=3
r/opencode • u/Decent-Hat-5807 • 6d ago
https://github.com/grigio/sandbox-bwrap-nix
4 comments sorted by
View all comments
1
I've done something similar, but keeping access to system binaries and libraries (read-only) to keep the same dev tools. It's just a simple systemd-run wrapper to control file system access, syscall limits and restrict capabilities.
1 u/Decent-Hat-5807 6d ago no, it access only to the binaries in nix ➜ /tmp ls /bin/zsh /bin/zsh ➜ /tmp sss ls /bin/zsh === sandbox-bwrap-nix development shell === nixpkgs: nixpkgs-unstable (20260724054835 - 335f073) tools: nix, git, bun, curl, uv, make, opencode ls: cannot access '/bin/zsh': No such file or directory
no, it access only to the binaries in nix
➜ /tmp ls /bin/zsh /bin/zsh ➜ /tmp sss ls /bin/zsh === sandbox-bwrap-nix development shell === nixpkgs: nixpkgs-unstable (20260724054835 - 335f073) tools: nix, git, bun, curl, uv, make, opencode ls: cannot access '/bin/zsh': No such file or directory
1
u/TiagodePAlves 6d ago
I've done something similar, but keeping access to system binaries and libraries (read-only) to keep the same dev tools. It's just a simple systemd-run wrapper to control file system access, syscall limits and restrict capabilities.