anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Suggestion: Implement isolated runtime sandboxing for code execution #8822

New Issue
Open
opened 2026-02-16 18:10:56 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:10:56 -05:00
Owner
Copy Link
Copy Source

Originally created by @Protocol-zero-0 on GitHub (Feb 8, 2026).

Originally assigned to: @thdxr on GitHub.

Proposal

As OpenCode executes arbitrary code generated by the LLM, implementing a robust sandboxing mechanism is critical for security, especially when handling untrusted inputs or plugins.

Suggested Approach

  • Integrate a containerized execution environment (e.g., Docker, firecracker-microvm) for running generated code.
  • Restrict network access and file system permissions by default.
  • Provide a clear API for plugins to request specific permissions.

This would significantly enhance the safety profile for users running OpenCode on local machines or shared servers.

⚡ Protocol Zero

Originally created by @Protocol-zero-0 on GitHub (Feb 8, 2026). Originally assigned to: @thdxr on GitHub. ## Proposal As OpenCode executes arbitrary code generated by the LLM, implementing a robust sandboxing mechanism is critical for security, especially when handling untrusted inputs or plugins. ### Suggested Approach - Integrate a containerized execution environment (e.g., Docker, firecracker-microvm) for running generated code. - Restrict network access and file system permissions by default. - Provide a clear API for plugins to request specific permissions. This would significantly enhance the safety profile for users running OpenCode on local machines or shared servers. ⚡ Protocol Zero
yindo commented 2026-02-16 18:10:56 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 8, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #6606: Spawn a separate process for tool calls - Proposes process isolation with security policies (selinux, apparmor, sandbox-exec)
  • #2242: Is there a way to sandbox the agent? - User asking about sandboxing agents to prevent unauthorized file access
  • #4667: Limiting access for tools in a safer way - Proposes bubblewrap on Linux with per-folder read/write permissions
  • #2206: Add exec tool as more secure alternative to bash tool - Addresses safety of arbitrary code execution
  • #5529: Add per-agent filesystem boundaries + optional run-as user - Comprehensive proposal for per-agent security boundaries and filesystem restrictions
  • #9647: Use sandboxing on macOS - Proposes integrating SandVault for agent isolation on macOS
  • #9132: Official Docker Sandbox Template - Proposes Docker containerization for complete isolation

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Feb 8, 2026): This issue might be a duplicate of existing issues. Please check: - #6606: Spawn a separate process for tool calls - Proposes process isolation with security policies (selinux, apparmor, sandbox-exec) - #2242: Is there a way to sandbox the agent? - User asking about sandboxing agents to prevent unauthorized file access - #4667: Limiting access for tools in a safer way - Proposes bubblewrap on Linux with per-folder read/write permissions - #2206: Add `exec` tool as more secure alternative to bash tool - Addresses safety of arbitrary code execution - #5529: Add per-agent filesystem boundaries + optional run-as user - Comprehensive proposal for per-agent security boundaries and filesystem restrictions - #9647: Use sandboxing on macOS - Proposes integrating SandVault for agent isolation on macOS - #9132: Official Docker Sandbox Template - Proposes Docker containerization for complete isolation Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8822
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?