sha256:8e66eb9d8a9aec015a6330525c4120849305e3a6c2e7f5780863283e20b54a84
Last pushed
8 days by cdupuis
Type
Sandbox Kit
Manifest digest
sha256:8e66eb9d8a9aec015a6330525c4120849305e3a6c2e7f5780863283e20b54a84
schemaVersion: "3"
displayName: OpenCode
author: Docker, Inc.
description: 'OpenCode as a complete workload: the sandbox-templates base with opencode pinned to the published release, seven optional proxy-managed provider credentials, scoped egress, and the MCP seed.'
sourceUrl: https://github.com/sst/opencode
kind: workload
provides:
- [email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/ca-certificates-java@20240118
- deb/ca-certificates@20250419
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/iputils-ping@20240905
- deb/[email protected]
- deb/[email protected]
- deb/less@668
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
capabilities:
- type: com.docker.sandbox/sbx@1
- type: com.docker.sandbox/network-policy@1
config:
runtime:
allow:
- api.anthropic.com:443
- claude.ai:443
- console.anthropic.com:443
- api.business.githubcopilot.com:443
- api.enterprise.githubcopilot.com:443
- api.github.com:443
- api.githubcopilot.com:443
- api.individual.githubcopilot.com:443
- copilot.github.com:443
- github.com:443
- '*.githubusercontent.com:443'
- raw.githubusercontent.com:443
- codeload.github.com:443
- aiplatform.googleapis.com:443
- generativelanguage.googleapis.com:443
- oauth2.googleapis.com:443
- vertexai.googleapis.com:443
- api.groq.com:443
- api.openai.com:443
- openai.com:443
- auth.openai.com:443
- chatgpt.com:443
- openrouter.ai:443
- api.x.ai:443
- registry.npmjs.org:443
- opencode.ai:443
- '*.opencode.ai:443'
- archive.ubuntu.com:80
- security.ubuntu.com:80
- ports.ubuntu.com:80
- download.docker.com:443
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.anthropic.com
format: '%s'
header: x-api-key
- domain: claude.ai
format: '%s'
header: x-api-key
- domain: console.anthropic.com
format: '%s'
header: x-api-key
name: ANTHROPIC_API_KEY
proxyManaged: true
phase: runtime
service: anthropic
description: Anthropic API access
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.business.githubcopilot.com
format: Bearer %s
header: Authorization
- domain: api.enterprise.githubcopilot.com
format: Bearer %s
header: Authorization
- domain: api.github.com
format: Bearer %s
header: Authorization
- domain: api.githubcopilot.com
format: Bearer %s
header: Authorization
- domain: api.individual.githubcopilot.com
format: Bearer %s
header: Authorization
- domain: copilot.github.com
format: Bearer %s
header: Authorization
- domain: github.com
format: Bearer %s
header: Authorization
- domain: raw.githubusercontent.com
format: Bearer %s
header: Authorization
name: GITHUB_TOKEN
proxyManaged: true
phase: runtime
service: github
description: GitHub and Copilot access
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: aiplatform.googleapis.com
format: '%s'
header: x-goog-api-key
- domain: generativelanguage.googleapis.com
format: '%s'
header: x-goog-api-key
- domain: oauth2.googleapis.com
format: '%s'
header: x-goog-api-key
- domain: vertexai.googleapis.com
format: '%s'
header: x-goog-api-key
name: GOOGLE_GENERATIVE_AI_API_KEY
proxyManaged: true
phase: runtime
service: google
description: Google AI API access
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.groq.com
format: Bearer %s
header: Authorization
name: GROQ_API_KEY
proxyManaged: true
phase: runtime
service: groq
description: Groq API access
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.openai.com
format: Bearer %s
header: Authorization
- domain: openai.com
format: Bearer %s
header: Authorization
name: OPENAI_API_KEY
proxyManaged: true
oauth:
credentialFile:
path: ~/.local/share/opencode/auth.json
structure:
openai:
access: '{{.AccessToken}}'
expires: '{{.ExpiresAt}}'
refresh: '{{.RefreshToken}}'
type: oauth
resourceHosts:
- chatgpt.com
sentinels:
accessToken: oai-oat01-proxy-managed
refreshToken: oai-ort01-proxy-managed
tokenEndpoint:
host: auth.openai.com
path: /oauth/token
phase: runtime
service: openai
description: OpenAI API access (API key or ChatGPT OAuth)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: openrouter.ai
format: Bearer %s
header: Authorization
name: OPENROUTER_API_KEY
proxyManaged: true
phase: runtime
service: openrouter
description: OpenRouter API access
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.x.ai
format: Bearer %s
header: Authorization
name: XAI_API_KEY
proxyManaged: true
phase: runtime
service: xai
description: xAI API access
- type: com.docker.sandbox/lifecycle@1
config:
startup:
- command: |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
mkdir -p "$HOME/.config/opencode"
cfg="$HOME/.config/opencode/opencode.json"
frag=/tmp/sandbox-mcp-gateway.json
jq -n --arg url "$MCP_GATEWAY_URL" --arg auth "Bearer $MCP_SENTINEL_TOKEN_NAME" \
'{"$schema": "https://opencode.ai/config.json", mcp: {"mcp-gateway": {type: "remote", url: $url, enabled: true, headers: {Authorization: $auth}}}}' > "$frag"
[ -f "$cfg" ] || echo '{}' > "$cfg"
jq -s '.[0] * .[1]' "$cfg" "$frag" > "$cfg.tmp"
mv "$cfg.tmp" "$cfg"
rm -f "$frag"
description: Register the sandbox MCP gateway by merging into opencode.json
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: agent
- type: com.docker.sandbox/agent-sessions@1
config:
prompt:
- run
- '{{.Prompt}}'
- type: com.docker.sandbox/agent-skills@1
optional: true
config:
path: /home/agent/.config/opencode/skills
- type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/opencode/opencode-context.md
filename: AGENTS.md
args:
version:
default: 1.18.32
description: OpenCode release to install
pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
buildArg: OPENCODE_VERSION
dockerfile: ./opencode.dockerfile