anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #2359] feat(docker): Run server in Docker with auth sync + local build #10287

New Issue
Closed
opened 2026-02-16 18:14:54 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:14:54 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/2359

State: closed
Merged: No

Adds an optional Docker-backed server mode for the TUI and headless server to isolate the runtime environment without sacrificing TUI performance.

The workspace isolation is especially useful in enterprise environments. Local machines can oftentimes contain lots of tools and credentials that are quite destructive. Allowing an AI agent to run on your local machine with the same basic access to your entire system as you have can be dangerous.

This instead isolates the opencode server to run inside a docker container with only the current working directory mounted inside as a volume. This way, the agent can only modify those files, and has no other access to the host system. Since only the server is running in the container and not the TUI itself, the performance penalty should be relatively minimal.

Why

  • Improve security/isolation by running the server in a container
  • Avoid host tooling/version conflicts while keeping the TUI native on the host
  • Keep this fully optional; default behavior is unchanged

What

  • TUI/Serve: --docker flag to start the server in Docker, mounting $PWD to /workspace and mapping a host port to container 8080.
  • Image: default to opencodeai/opencode:server; support --docker-image.
  • Local builds: support --dockerfile, --docker-context, --docker-build for building a local image; added script/docker-build and docker:build script.
  • Auth: sync only opencode-managed provider credentials to the server (PUT /auth/:id) and inject only provider-defined env vars (from models.dev) into the container (e.g. OPENAI_API_KEY, ANTHROPIC_API_KEY). No $HOME/XDG dirs are mounted.
  • Dockerfile: based on oven/bun; installs minimal tools (git, curl, unzip, tar, nodejs, npm, golang) and runs bun run /app/src/index.ts serve --hostname 0.0.0.0 --port 8080.
  • CI: GitHub Action to publish opencodeai/opencode:server on release (multi-arch).
  • Docs: README snippet for Docker usage.
  • Config: add server.docker (bool) and server.image so plain opencode can auto-use Docker server mode by default.

Usage

  • TUI: opencode --docker (uses Hub image) or opencode --docker --docker-image opencode:local after a local build
  • Serve: opencode serve --docker --port 8080
  • Build: bun run docker:build (tags both opencodeai/opencode:server and opencode:local)

Notes

  • Backwards-compatible and opt-in.
  • Only provider credentials are synced; no other host secrets are exposed.
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/2359 **State:** closed **Merged:** No --- Adds an optional Docker-backed server mode for the TUI and headless server to isolate the runtime environment without sacrificing TUI performance. The workspace isolation is especially useful in enterprise environments. Local machines can oftentimes contain lots of tools and credentials that are quite destructive. Allowing an AI agent to run on your local machine with the same basic access to your entire system as you have can be dangerous. This instead isolates the opencode server to run inside a docker container with only the current working directory mounted inside as a volume. This way, the agent can only modify those files, and has no other access to the host system. Since only the server is running in the container and not the TUI itself, the performance penalty should be relatively minimal. Why - Improve security/isolation by running the server in a container - Avoid host tooling/version conflicts while keeping the TUI native on the host - Keep this fully optional; default behavior is unchanged What - TUI/Serve: `--docker` flag to start the server in Docker, mounting `$PWD` to `/workspace` and mapping a host port to container `8080`. - Image: default to `opencodeai/opencode:server`; support `--docker-image`. - Local builds: support `--dockerfile`, `--docker-context`, `--docker-build` for building a local image; added `script/docker-build` and `docker:build` script. - Auth: sync only opencode-managed provider credentials to the server (`PUT /auth/:id`) and inject only provider-defined env vars (from models.dev) into the container (e.g. `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`). No $HOME/XDG dirs are mounted. - Dockerfile: based on `oven/bun`; installs minimal tools (`git`, `curl`, `unzip`, `tar`, `nodejs`, `npm`, `golang`) and runs `bun run /app/src/index.ts serve --hostname 0.0.0.0 --port 8080`. - CI: GitHub Action to publish `opencodeai/opencode:server` on release (multi-arch). - Docs: README snippet for Docker usage. - Config: add `server.docker` (bool) and `server.image` so plain `opencode` can auto-use Docker server mode by default. Usage - TUI: `opencode --docker` (uses Hub image) or `opencode --docker --docker-image opencode:local` after a local build - Serve: `opencode serve --docker --port 8080` - Build: `bun run docker:build` (tags both `opencodeai/opencode:server` and `opencode:local`) Notes - Backwards-compatible and opt-in. - Only provider credentials are synced; no other host secrets are exposed.
yindo added the pull-request label 2026-02-16 18:14:54 -05:00
yindo closed this issue 2026-02-16 18:14:54 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#10287
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?