fix: reduce permissions and fix npm and opencode versions

dev.sh

@@ -18,7 +18,6 @@ M2_FOLDER="${M2_FOLDER:-$BASE_DIR/m2}"
 NPM_MODULES="${NPM_MODULES:-$BASE_DIR/npm-modules}"
 NPM_CACHE="${NPM_CACHE:-$BASE_DIR/npm-cache}"
 PIP_CACHE="${PIP_CACHE:-$BASE_DIR/pip-cache}"
-CERTIFICATES="${CERTIFICATES:-$BASE_DIR/certs}"
 BASH_FOLDER="${BASH_FOLDER:-$BASE_DIR/bash}"
 
 mkdir -p \
@@ -31,7 +30,6 @@ mkdir -p \
     "$NPM_MODULES" \
     "$NPM_CACHE" \
     "$PIP_CACHE" \
-    "$CERTIFICATES" \
     "$BASH_FOLDER"
 
 if [[ ! -f "$HOME/.gitconfig" ]]; then
@@ -63,7 +61,6 @@ if [[ ! -d "$PROJECTS_DIR" ]]; then
   exit 1
 fi
 
-# --security-opt=no-new-privileges
 ARGS=(
   run --rm -it
   --name opencode-dev
@@ -71,6 +68,10 @@ ARGS=(
   --userns=keep-id
   --network=default
   --tz=local
+
+  --security-opt=no-new-privileges
+  --cap-drop=ALL
+
   -e "HOST_LANG=${LANG:-C.UTF-8}"
   -e "HOST_LC_ALL=${LC_ALL:-}"
   -e "START_DIR=${START_DIR}"
@@ -81,7 +82,6 @@ ARGS=(
   -v "$M2_FOLDER:/home/dev/.m2:rw"
   -v "$NPM_CACHE:/home/dev/.npm:rw"
   -v "$PIP_CACHE:/home/dev/.cache/pip:rw"
-  -v "$CERTIFICATES:/host-certs:ro"
   -v "$PROJECTS_DIR:/workspace:rw"
   -v "$HOME/.gitconfig:/home/dev/.gitconfig:ro"
   # -v "$HOME/.ssh:/home/dev/.ssh:ro"