bubblewrap_opencode/bubblewrap_opencode at main · ast0815/bubblewrap_opencode · GitHub

History

59 lines (42 loc) · 1.52 KB

Raw

#!/usr/bin/env bash

set -eo pipefail

TARGET_EXECUTABLE="$(which opencode)"

if [ ! -f "${TARGET_EXECUTABLE}" ]; then

echo "Could not find opencode executable!"

# Save current-folder as that will be mapped in as read-write and the current folder we execute in.

CURRENT_FOLDER=${PWD}

# Resolve the real binary path (follows alternatives, flatpak, etc.)

REAL_COMMAND="$(readlink -f "$TARGET_EXECUTABLE")"

# Build the full bwrap argument array

bwrap_args=(

bwrap

# Drop as many privilieges as possible

--unshare-all

# But allow network access

--share-net

# Start a fresh session

--new-session

--die-with-parent

# Mount the whole file system read-only

--ro-bind / /

# Add dev and proc special binds

--dev /dev

--proc /proc

# Add some temporary file systems

--tmpfs /tmp

# SSH doesn't like the "nobody" ownership of ro files

# Hide global ssh config

--tmpfs /etc/ssh/

# Also, it might need to create files here

--bind-try "${HOME}/.ssh" "${HOME}/.ssh"

# Access to necessary caches etc

--bind-try "${HOME}/.bun" "${HOME}/.bun"

--bind-try "${HOME}/.cache" "${HOME}/.cache"

--bind-try "${HOME}/.local/share/opencode" "${HOME}/.local/share/opencode"

--bind-try "${HOME}/.local/state/opencode" "${HOME}/.local/state/opencode"

--bind-try "${XDG_CACHE_HOME}/opencode" "${XDG_CACHE_HOME}/opencode"

# Make the current directory writable

--bind "${CURRENT_FOLDER}" "${CURRENT_FOLDER}"

)

exec "${bwrap_args[@]}" -- "$REAL_COMMAND" "$@"

bubblewrap_opencode/bubblewrap_opencode at main · ast0815/bubblewrap_opencode · GitHub

Expand file tree

Breadcrumbs

bubblewrap_opencode

Latest commit

History

Breadcrumbs

bubblewrap_opencode

File metadata and controls