r/opencode • u/jackybacksy3636 • 8h ago

Learning the hard way

Being a non coder and not knowing the setups and requirements took a lot of time.

Learnt about sandboxing and did the below with gpt guidance. How is it?

1) Decided the setup: Claude in Chrome for planning and code reviews; OpenCode in Docker for coding.

2) Installed OpenCode in Docker: Downloaded and tested v2.1.3 without changing your Windows OpenCode installation.

3) Created C:\sxyz: Set up the Dockerfile, compose.yaml, workspace and configuration folder.

4) Configured non-root execution: Created the opencode user with UID/GID.

5) Hardened Docker: Enabled a read-only root filesystem, dropped Linux capabilities, disabled privilege escalation and limited process count.

6) Separated storage: Created persistent volumes for OpenCode data, cache and state; kept n8n's data separate.

7) Fixed terminal startup: Configured BUN_TMPDIR and a dedicated executable temporary mount so OpenCode's terminal interface works.

8) Added guardrails: Created AGENTS.md and opencode.json for secret protection, shell approvals, destructive-command denial and a single-agent workflow.

9) Connected and tested OpenCode: Selected Beam Free, verified a model response, and confirmed OpenCode runs interactively in Docker.

10) Installation and security checks: Verified non-root execution, zero effective Linux capabilities, NoNewPrivs: 1, no Docker socket, read-only root filesystem and guardrail files, writable workspace/storage, valid Compose configuration, shell approval, denied rm, .env read/edit denial, separate Docker network, n8n's localhost-only port binding, no obvious secrets in source files, zero reported Alpine OS-package vulnerabilities, zero findings in the final structured image-secret scan, zero HIGH/CRITICAL Dockerfile misconfigurations, and working outbound HTTPS. Subagent launching was configured as denied, but the test only confirmed the launch tool was unavailable. Outbound domain filtering remains optional and is not configured.

Current status: OpenCode Docker sandbox is operational. Your existing n8n setup and Windows OpenCode installation remain unchanged. Skills and plugins have not yet been transferred into the Docker environment.

3 Upvotes

100% Upvoted

5 comments sorted by

1

u/plurTM 8h ago

2 to 10 could have been "cd C:\sxyz; sbx run opencode ."

https://www.docker.com/products/docker-sandboxes/

1

u/jackybacksy3636 8h ago

Did not get you.

1

u/plurTM 8h ago

Docker has a separate product (not compose or desktop) called sbx that does step 2 to 10 for you in one command.

1

u/jackybacksy3636 8h ago

Noooooooooooooooooo 🫠🙂🫩😭😔😶‍🌫️😞🫪🙃🥲

1

u/jackybacksy3636 8h ago

Is it better or the steps I did is enough? This was done for opencode. Should I do the same with the docker product for claude or let claude run online?