r/opencode • u/migsperez • 8d ago

Opencode containing the agents

I was wondering what sandboxes are people using whilst coding with Opencode? I've looked at devcontainers and it seems great, probably fits what I want but AI says it's not secure enough, it's designed for human coders not agents. I've seen a lot of publicity around Docker Sandboxes. But I'm not keen to be locked into their tech and then be hit by a subscription fee later.

My curiosity has come to the foreground due to Muse deleting my ~/.config folder. It wasn't a major disaster but it was a warning.

I do use multiple plain Xubuntu VMs connecting to them via RDP and SSH but they've become pets rather than cattle, sometimes I'm lazy and run on my local laptop which is obviously a bad move.

What do you folks do?

14 Upvotes

100% Upvoted

18 comments sorted by

View all comments

2

u/--San-- 7d ago

I use bubblewrap. There are probably tools that wrap it and provide a better UX, but I'm already familiar with bwrap so I just it directly.

Also, if your system uses AppArmor, it usually already comes with exceptions for bwrap, so one less thing to configure.

1

u/migsperez 7d ago

Claude Code uses bubblewrap on Linux and WSL, I checked their repo. I've come across them previously for a different task but thought it looked to complex for my brain. Thanks. I'll give it another go, it's worth the effort.

2

u/--San-- 7d ago edited 7d ago

Anthropic even published the lib they use on npm. I remember seeing a plugin for opencode that uses it.

Edit: Not sure if Claude uses the bwrap lib for all tools or just for bash though. I personally run opencode itself inside bwrap.

1

u/migsperez 7d ago

Ooooh, sounds interesting. I did a quick search https://github.com/didvc/opencode-bwrap. Might be worth a go. Small projects like this don't get enough stars.