ian/opencode-container
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update README.md

Browse Source
This commit is contained in:
Ian
2026-10-05 08:56:27 +02:00
parent 754fa84a5e
commit 92e09fe29c
4 changed files with 72 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+1 -1
View File
@@ -4,7 +4,7 @@ ARG UBUNTU_VERSION=26.04
FROM ubuntu:${UBUNTU_VERSION}
ARG NODE_VERSION=24.21.0
ARG OPENCODE_VERSION=2.0.3
ARG OPENCODE_VERSION=2.0.22
ARG EXTRA_APT_PACKAGES=""
README.md
+70 -57
View File
@@ -17,9 +17,9 @@ The host project directory and selected development caches/configuration directo
## Files
* `Dockerfile` — builds the development image.
* `build.sh` — builds or updates the image.
* `dev.sh` — starts the development container.
* `entrypoint.sh` — initializes the runtime environment.
* `build.sh` — builds, updates, removes, or prunes the image.
* `run.sh` — starts the development container.
* `certs/README.md` — rules for custom CA certificates.
## Build the image
@@ -49,12 +49,37 @@ The build uses the current host UID and GID for the `dev` user, so files created
./build.sh --update
```
This is equivalent to `--no-cache --pull=newer`, so the Ubuntu base image is refreshed and every package layer is reinstalled.
### Show the build command without running it
```bash
./build.sh --dry-run
```
### Remove or prune images
```bash
./build.sh --remove # delete the development image
./build.sh --prune # delete dangling images left by previous builds
```
Both options exit immediately without building, and can be combined.
### Install extra system packages
```bash
./build.sh --apt-packages="libpq-dev postgresql-client"
```
The list is forwarded to the image build as `EXTRA_APT_PACKAGES` and installed with `apt-get install --no-install-recommends`.
### Show usage
```bash
./build.sh --help
```
## Build arguments
The following environment variables can be used to customize the image:
@@ -62,21 +87,28 @@ The following environment variables can be used to customize the image:
```bash
UBUNTU_VERSION=26.04
NODE_VERSION=24.21.0
OPENCODE_VERSION=2.0.3
OPENCODE_VERSION=2.0.22
IMAGE_REPO=localhost/opencode-dev
```
For example:
```bash
NODE_VERSION=24.21.0 OPENCODE_VERSION=2.0.3 ./build.sh --no-cache
NODE_VERSION=24.21.0 OPENCODE_VERSION=2.0.22 ./build.sh --no-cache
```
`build.sh` passes the versions above to `podman build` as `--build-arg`. The same values are declared as `ARG` defaults at the top of the `Dockerfile`, so keep both in sync when changing a version.
Two more build arguments are set automatically:
* `DEV_UID` / `DEV_GID` — taken from `id -u` / `id -g` on the host.
* `EXTRA_APT_PACKAGES` — taken from the `--apt-packages` option.
## Custom CA certificates
Custom CA certificates must be placed in the repository `certs/` directory before building the image. See [`certs/README.md`](certs/README.md) for accepted formats and rules.
This directory is kept in git through a placeholder file, so a fresh clone builds without creating it first.
Git cannot track empty directories, so `certs/README.md` itself is the placeholder that keeps `certs/` present in a fresh clone, and the build does not fail on a missing directory. That placeholder is listed in `.dockerignore`, so only real certificate files are copied into the image.
The Dockerfile copies this directory to:
@@ -105,7 +137,7 @@ This allows both system tools and Node.js applications to trust the additional c
Run:
```bash
./dev.sh
./run.sh
```
By default, the host directory is:
@@ -120,21 +152,9 @@ and projects are stored in:
$HOME/opencode-dev/projects
```
The container starts in `/workspace`.
`run.sh` creates every directory it mounts, so it can be run on a clean checkout. If the image does not exist yet, the script exits with an error asking you to build it first.
To start in a specific project:
```bash
./dev.sh my-project
```
or:
```bash
./dev.sh /path/to/opencode-dev/projects/my-project
```
Absolute paths outside the projects directory are not accepted as the initial working directory.
The container starts in `/workspace`, which is the mounted `projects/` directory. Open the project you want to work on inside the shell, or mount additional host directories with `--mount`.
## Mounted directories
@@ -149,10 +169,9 @@ The following host directories are mounted into the container:
| `m2/` | `/home/dev/.m2` | Maven cache |
| `npm-cache/` | `/home/dev/.npm` | npm cache |
| `pip-cache/` | `/home/dev/.cache/pip` | pip cache |
| `bash/` | `/host-bash` | Host-provided Bash configuration |
| `$HOME/.gitconfig` | `/home/dev/.gitconfig` | Git configuration |
All standard development directories are created automatically by `dev.sh`.
All mounted development directories are created automatically by `run.sh`.
## Additional mounts
@@ -161,23 +180,25 @@ Additional host directories can be mounted with `--mount`.
Example:
```bash
./dev.sh my-project --mount "$HOME/other:/extra"
./run.sh --mount "$HOME/other:/extra"
```
Read-only mounts are also supported:
```bash
./dev.sh my-project --mount "$HOME/data:/data:ro"
./run.sh --mount "$HOME/data:/data:ro"
```
Multiple mounts can be specified:
```bash
./dev.sh my-project \
./run.sh \
--mount "$HOME/data:/data:ro" \
--mount "$HOME/tools:/tools:rw"
```
`--mount` is the only option accepted by `run.sh`; any other argument stops the script with an error.
## Environment variables
The main runtime paths can be customized:
@@ -191,14 +212,15 @@ OPENCODE_CACHE
M2_FOLDER
NPM_CACHE
PIP_CACHE
BASH_FOLDER
IMAGE_REPO
```
`IMAGE_REPO` is read by both scripts, so it selects the same image for `build.sh` and `run.sh`.
Example:
```bash
OPENCODE_DEV_HOME="$HOME/my-opencode" ./dev.sh
OPENCODE_DEV_HOME="$HOME/my-opencode" ./run.sh
```
## Git configuration
@@ -211,38 +233,35 @@ $HOME/.gitconfig -> /home/dev/.gitconfig
If the file does not exist, the script prints a warning and Git uses the container defaults.
SSH configuration and SSH agent forwarding are currently disabled in the script. They can be enabled by uncommenting the corresponding sections in `dev.sh`.
SSH configuration and SSH agent forwarding are not mounted. If they are needed, pass them explicitly:
```bash
./run.sh --mount "$HOME/.ssh:/home/dev/.ssh:ro"
```
## Security
The container runs with several restrictions:
* Runs as the `dev` user.
* Uses the host UID/GID.
* Drops all Linux capabilities.
* Runs as the `dev` user with host UID/GID (`--user dev --userns=keep-id`).
* Drops all Linux capabilities (`--cap-drop=ALL`).
* Uses `no-new-privileges`.
* Uses a temporary container (`--rm`).
* Uses the host timezone (`--tz=local`).
* Uses a temporary, named container (`--name opencode-dev --rm`).
* Does not run as root.
* Uses the default Podman network.
The project directory is mounted read/write because the AI agent needs to create and modify source files.
The project directory is mounted read/write because the AI agent needs to create and modify source files. The host Git configuration is mounted read-only.
## Locale
The host locale is passed to the container through:
The image generates the `en_US.UTF-8` locale during the build:
```text
HOST_LANG
HOST_LC_ALL
```dockerfile
echo 'en_US.UTF-8 UTF-8' > /etc/locale.gen && locale-gen
```
The entrypoint generates the requested UTF-8 locale when necessary.
For example, the host locale is automatically passed when running:
```bash
./dev.sh
```
The host timezone is applied at runtime through `--tz=local`. The host `LANG`/`LC_ALL` values are not forwarded; export them inside the container if a different locale is needed.
## Typical workflow
@@ -255,22 +274,16 @@ Build the image:
Start the development environment:
```bash
./dev.sh
./run.sh
```
Or start directly in a project:
```bash
./dev.sh my-project
```
Inside the container, the project is available under:
Inside the container, the projects directory is available under:
```bash
/workspace
```
OpenCode can then be started normally:
Move into the project you want to work on, then start OpenCode normally:
```bash
opencode
@@ -280,14 +293,14 @@ The container is removed when the shell exits, while source code, OpenCode data,
## Customization
Most image versions are defined at the top of the `Dockerfile`:
Image versions are defined at the top of the `Dockerfile`:
```dockerfile
ARG UBUNTU_VERSION=26.04
ARG NODE_VERSION=24.21.0
ARG OPENCODE_VERSION=2.0.3
ARG OPENCODE_VERSION=2.0.22
```
Runtime paths and container options are defined in `dev.sh`.
Runtime paths, mounts, and container options are defined in `run.sh`, while `build.sh` controls how the image is built and maintained.
This separation allows the image to contain the stable development environment while projects, configuration, caches, and other working data remain outside the container.
certs/README.md
-1
View File
@@ -5,7 +5,6 @@ in this directory, as PEM files with a `.crt` or `.pem` extension:
```text
certs/
├── .gitignore
├── README.md
├── company-root.crt
└── company-intermediate.crt
run.sh
+1 -1
View File
@@ -56,7 +56,7 @@ else
fi
# Additional bind mounts:
# ./dev.sh --mount "$HOME/other:/extra"
# ./run.sh --mount "$HOME/other:/extra"
while (($#)); do
case "$1" in
--mount)