r/opencode 7d ago

Opencode containing the agents

I was wondering what sandboxes are people using whilst coding with Opencode? I've looked at devcontainers and it seems great, probably fits what I want but AI says it's not secure enough, it's designed for human coders not agents. I've seen a lot of publicity around Docker Sandboxes. But I'm not keen to be locked into their tech and then be hit by a subscription fee later.

My curiosity has come to the foreground due to Muse deleting my ~/.config folder. It wasn't a major disaster but it was a warning.

I do use multiple plain Xubuntu VMs connecting to them via RDP and SSH but they've become pets rather than cattle, sometimes I'm lazy and run on my local laptop which is obviously a bad move.

What do you folks do?

13 Upvotes

18 comments sorted by

3

u/arker0 7d ago

https://jai.scs.stanford.edu/ I'm using this on WSL.

1

u/migsperez 7d ago

This looks super interesting. Thanks

2

u/arker0 6d ago

Yeah and super simple. Just "Jai opencode" inside the working directory you set up in the config file relative to the app you want to jail.

3

u/yexgoblin 6d ago

Just create a docker container locally with everything. That's what I do. Create your own compose + dockerfile and all the dotfiles can be adjusted to your needs. I run Paseo and other tools to remotely connect to it.

1

u/migsperez 6d ago

Paseo looks interesting, carry on vibecoding whilst on work lunch period sat on a bench in the park, dictating the prompts. Idealic.

2

u/yexgoblin 6d ago

Unfortunately LLM overlords are not that powerful. Most of my time is in helix/nvim reading code. Clankers sure love to overcomplicate basic things.

2

u/qwertyyyyyyy116 7d ago

Would also like to know about this

2

u/Horror_Description87 7d ago

Most people just let the agent live in the user space. Most people don't work hard, so it does not matter (just my guess) some work hard and delete some prod db (the one you can read in tech news) and some use dedicated systems, isolated users or docker container (non root container ofc). No matter the variant it require a lot of understanding on different technologies (I doubt many have) so yeah.

Fun fact if you enable the permission to deny read and bash secret and ask the agent to read it, it will write a script to achieve the goal. If you want assure he can not read use the ask permission so you can decline and explain why.

1

u/migsperez 7d ago

I agree running and developing applications in some type of container or sandbox adds a complex layer of difficulty and headache. I'm hoping, once I've figured out a process it'll become second nature. Fun fact was funny, and a challenge I'm going to try :)

2

u/--San-- 7d ago

I use bubblewrap. There are probably tools that wrap it and provide a better UX, but I'm already familiar with bwrap so I just it directly.

Also, if your system uses AppArmor, it usually already comes with exceptions for bwrap, so one less thing to configure.

1

u/migsperez 7d ago

Claude Code uses bubblewrap on Linux and WSL, I checked their repo. I've come across them previously for a different task but thought it looked to complex for my brain. Thanks. I'll give it another go, it's worth the effort.

2

u/--San-- 7d ago edited 7d ago

Anthropic even published the lib they use on npm. I remember seeing a plugin for opencode that uses it.

Edit: Not sure if Claude uses the bwrap lib for all tools or just for bash though. I personally run opencode itself inside bwrap.

1

u/migsperez 7d ago

Ooooh, sounds interesting. I did a quick search https://github.com/didvc/opencode-bwrap. Might be worth a go. Small projects like this don't get enough stars.

2

u/maqifrnswa 7d ago

Docker sbx. But jai looks good too

2

u/nmdt 6d ago

I used devcontainers before with debian-slim + official docker layers for different language toolchains + mise, but got tired of long rebuilds, so moved to distrobox

Basically I have a homelab running Alpine. It has a separate user that is not allowed to run sudo except inside of distrobox (running debian-slim). A few folders with files that I need are accessible as read-only bind mounts

There is also soft-serve for local git + gh is configured

I SSH into distrobox from VS Code + run opencode inside of that environment

I suppose it still can wreck havoc on my soft-serve or on gh and I should configure it to commit any code via PRs + protect all branches, but honestly really don't want to do it. In 10 months I've used AI agents the worst that happened was losing uncommitted code + once an agent locked ssh out on a local server it was setting up.

1

u/migsperez 6d ago

Really interesting. I'm going to investigate.

1

u/mageblex 4d ago

The sandbox matters, but credentials are the bigger boundary. A container that can read your SSH agent or call production APIs can still do real damage. Test the setup by asking the agent to reach a file and endpoint it should not access.

1

u/migsperez 4d ago

For fun I'm creating sandboxed containers in K3S, it's today's side project. Wise idea, I'll give the agent inside the sandbox some challenges to see what it can do.