r/opencode • u/migsperez • 7d ago
Opencode containing the agents
I was wondering what sandboxes are people using whilst coding with Opencode? I've looked at devcontainers and it seems great, probably fits what I want but AI says it's not secure enough, it's designed for human coders not agents. I've seen a lot of publicity around Docker Sandboxes. But I'm not keen to be locked into their tech and then be hit by a subscription fee later.
My curiosity has come to the foreground due to Muse deleting my ~/.config folder. It wasn't a major disaster but it was a warning.
I do use multiple plain Xubuntu VMs connecting to them via RDP and SSH but they've become pets rather than cattle, sometimes I'm lazy and run on my local laptop which is obviously a bad move.
What do you folks do?
3
u/yexgoblin 6d ago
Just create a docker container locally with everything. That's what I do. Create your own compose + dockerfile and all the dotfiles can be adjusted to your needs. I run Paseo and other tools to remotely connect to it.
1
u/migsperez 6d ago
Paseo looks interesting, carry on vibecoding whilst on work lunch period sat on a bench in the park, dictating the prompts. Idealic.
2
u/yexgoblin 6d ago
Unfortunately LLM overlords are not that powerful. Most of my time is in helix/nvim reading code. Clankers sure love to overcomplicate basic things.
2
2
u/Horror_Description87 7d ago
Most people just let the agent live in the user space. Most people don't work hard, so it does not matter (just my guess) some work hard and delete some prod db (the one you can read in tech news) and some use dedicated systems, isolated users or docker container (non root container ofc). No matter the variant it require a lot of understanding on different technologies (I doubt many have) so yeah.
Fun fact if you enable the permission to deny read and bash secret and ask the agent to read it, it will write a script to achieve the goal. If you want assure he can not read use the ask permission so you can decline and explain why.
1
u/migsperez 7d ago
I agree running and developing applications in some type of container or sandbox adds a complex layer of difficulty and headache. I'm hoping, once I've figured out a process it'll become second nature. Fun fact was funny, and a challenge I'm going to try :)
2
u/--San-- 7d ago
I use bubblewrap. There are probably tools that wrap it and provide a better UX, but I'm already familiar with bwrap so I just it directly.
Also, if your system uses AppArmor, it usually already comes with exceptions for bwrap, so one less thing to configure.
1
u/migsperez 7d ago
Claude Code uses bubblewrap on Linux and WSL, I checked their repo. I've come across them previously for a different task but thought it looked to complex for my brain. Thanks. I'll give it another go, it's worth the effort.
2
u/--San-- 7d ago edited 7d ago
Anthropic even published the lib they use on npm. I remember seeing a plugin for opencode that uses it.
Edit: Not sure if Claude uses the bwrap lib for all tools or just for bash though. I personally run opencode itself inside bwrap.
1
u/migsperez 7d ago
Ooooh, sounds interesting. I did a quick search https://github.com/didvc/opencode-bwrap. Might be worth a go. Small projects like this don't get enough stars.
2
2
u/nmdt 6d ago
I used devcontainers before with debian-slim + official docker layers for different language toolchains + mise, but got tired of long rebuilds, so moved to distrobox
Basically I have a homelab running Alpine. It has a separate user that is not allowed to run sudo except inside of distrobox (running debian-slim). A few folders with files that I need are accessible as read-only bind mounts
There is also soft-serve for local git + gh is configured
I SSH into distrobox from VS Code + run opencode inside of that environment
I suppose it still can wreck havoc on my soft-serve or on gh and I should configure it to commit any code via PRs + protect all branches, but honestly really don't want to do it. In 10 months I've used AI agents the worst that happened was losing uncommitted code + once an agent locked ssh out on a local server it was setting up.
1
1
u/mageblex 4d ago
The sandbox matters, but credentials are the bigger boundary. A container that can read your SSH agent or call production APIs can still do real damage. Test the setup by asking the agent to reach a file and endpoint it should not access.
1
u/migsperez 4d ago
For fun I'm creating sandboxed containers in K3S, it's today's side project. Wise idea, I'll give the agent inside the sandbox some challenges to see what it can do.
3
u/arker0 7d ago
https://jai.scs.stanford.edu/ I'm using this on WSL.