Opencode Bwrap

Sandboxed Opencode runtime using bubblewrap with configurable bind mounts.

Quick Start

curl -fsSL https://raw.githubusercontent.com/cyunrei/opencode-bwrap/master/install-remote.sh | bash

opencode-bwrap
opencode-bwrap serve

opencode-bwrap works the same as opencode but runs in a sandbox.

For security, only configured paths are accessible. Add your project and tool directories to ~/.config/opencode-bwrap/bwrap.conf:

# Toolchains
bind:~/.cargo:~/.cargo
bind:~/.bun:~/.bun

# Projects
bind:~/projects:~/projects

Or enable quick access to current directory:

echo "bind:\$PWD:\$PWD" >> ~/.config/opencode-bwrap/bwrap.conf

Config file: ~/.config/opencode-bwrap/bwrap.conf

Format: type:source:destination

Types: bind, ro-bind, bind-try, ro-bind-try, symlink

See bwrap.conf.example for examples.

curl -fsSL https://raw.githubusercontent.com/cyunrei/opencode-bwrap/master/uninstall-remote.sh | bash