Comment by tomrod
4 days ago
Nice work!
Are there any recommended sandbox patterns to use? Custom linux users or bubblewrap and managing openbao is getting to be a lot to manage each harness by themselves!
4 days ago
Nice work!
Are there any recommended sandbox patterns to use? Custom linux users or bubblewrap and managing openbao is getting to be a lot to manage each harness by themselves!
I've been using https://nono.sh which uses landlock instead of bubblewrap. I had a look at all the similar alternatives when I started using it and everything else I could find was far too vibe coded for me to trust, especially for this.
[dead]
Make sure to use the —standalone flag with sandbox invocations of opencode, else you will run the client in a sandbox but not the server.
Microsoft has mxc which I think is neat — not sure if it’s the right level of abstraction for your needs
https://github.com/microsoft/mxc