Table of Contents
- OpenCode has no built-in sandbox, and the maintainers say so
- Why permissions are not an OpenCode sandbox
- Option 1: OS-level wrappers (bubblewrap, sandbox-exec, firejail)
- Option 2: Docker or Podman on your machine
- Option 3: Cloud sandboxes built for agents
- The always-on OpenCode sandbox: Agent37
- Which OpenCode sandbox should you pick?
- OpenCode sandbox FAQ
- Does OpenCode have a built-in sandbox?
- Is opencode --auto safe to use?
- Can OpenCode run in Docker?
- How much does an always-on OpenCode sandbox cost?
Do not index
OpenCode does not ship with a sandbox. The open source coding agent controls its tools with permission prompts, and its own maintainers admit the agent can use bash to get around the working-directory restriction. So an "OpenCode sandbox" is something you add yourself, and in 2026 you have three real options: an OS-level wrapper like bubblewrap, a Docker container on your machine, or a hosted sandbox like Agent37, where an always-on OpenCode box costs $4.76 a month on a gVisor-isolated instance.
This guide compares all three, with working setups, the traps each one hides, and verified October 2026 prices.
OpenCode has no built-in sandbox, and the maintainers say so
OpenCode is, by GitHub stars, the most popular open source coding agent: MIT licensed, built by Anomaly, past 200,000 stars, with multiple releases a week (v1.19.3 shipped October 16, 2026). It talks to 75+ model providers, so the agent itself is free. You pay for the model and for somewhere to run it.
What it does not have is isolation. The canonical GitHub issue asking for a way to sandbox the agent has been open since 2025 and is still collecting workarounds today. An OpenCode collaborator put it plainly in that thread: "we need better sandboxing, we try to restrict to cwd but agent can use bash to get around it."
Check the config reference yourself: there is no
sandbox key, no seatbelt, no bubblewrap, no Landlock. Compare that with the competition. Codex ships an OS-level sandbox (Seatbelt on macOS out of the box, bubblewrap on Linux, plus a native Windows mode; we covered the details in our Codex sandbox guide), and Claude Code added a native /sandbox mode (see every Claude Code sandbox option). In the OpenCode thread, commenters ask whether Anthropic's open source sandbox-runtime could be wired in, or Codex's sandbox ported over, and a collaborator replied they would look into it.Until that happens, the boundary is yours to build.
Why permissions are not an OpenCode sandbox
OpenCode's permission system is good UX. You set
allow, ask, or deny per tool in opencode.json, with pattern maps for bash commands where the last matching rule wins, so the catch-all goes first:{
"permission": {
"bash": {
"*": "ask",
"git *": "allow",
"rm *": "deny"
}
}
}Three problems stop this being a security boundary.
The defaults are open. Most permissions default to
allow. The read tool denies .env files by default, but nothing stops an allowed bash call from running cat .env or python3 -c "print(open('.env').read())". Deny patterns match command strings, not effects.Auto-approve removes the human. Run
opencode --auto and the agent approves every request that is not explicitly denied. That is exactly how people want to run long autonomous sessions, and exactly when a prompt-injected or hallucinating agent does the most damage. The fear users keep posting in that GitHub thread is concrete: an agent with bash and network access can POST your files anywhere.The attack surface is real. OpenCode's published security advisories include an unauthenticated server hole that allowed arbitrary command execution (CVE-2026-22812, fixed in 1.0.216), a web UI XSS that let a malicious website run commands on your machine (CVE-2026-22813, fixed in 1.1.10), and a cross-site request that could install arbitrary npm packages (fixed in 1.18.22). The project moves fast and fixes fast, but "the permission prompt will save me" is not a plan.
A sandbox assumes the agent will eventually do something wrong and makes the blast radius small. Here are your three options, cheapest-effort first.
Option 1: OS-level wrappers (bubblewrap, sandbox-exec, firejail)
The lightest fix keeps OpenCode on your machine and wraps its commands in the OS's own sandboxing primitives. The community opencode-sandbox plugin does this automatically: every bash tool call runs under
sandbox-exec on macOS or bubblewrap on Linux, with writes restricted to the project directory and /tmp, reads of sensitive paths like ~/.ssh denied, and network limited to an allowlist. Hacker News threads add firejail recipes for the same idea (incus comes up too, but that is image-based and closer to Option 2's container model).What you get: native filesystem speed, no images to build, your normal git and editor setup untouched.
What you give up: you are still sharing your kernel and your network. A wrapper that only guards the bash tool does not guard everything else, misconfigured profiles fail silently, and there is no Windows story at all. This is a seatbelt, not a crash cage. It fits interactive daily coding on repos you trust, with permissions still set to
ask for anything destructive.Option 2: Docker or Podman on your machine
The step up is running the whole agent in a container. OpenCode publishes an official image,
ghcr.io/anomalyco/opencode, and the pattern is simple: bind-mount only the one project you are working on, keep a named volume for OpenCode's state so you are not logging in every session, and run --auto knowing the blast radius is the container and that one directory, provided you also close egress.Two traps from the GitHub threads worth designing around. First, credentials: persist
~/.local/share/opencode (where auth.json lives), plus ~/.config/opencode for global config, or the agent forgets who you are between runs. Second, exfiltration: a container with open egress can still ship your code anywhere, so an outbound firewall or allowlist matters more than most people's deny rules. Our opencode-docker repo packages this: the official image pinned, a non-root user, a compose file for the TUI, and an egress-firewalled autonomous mode.The honest limits: containers share the host kernel, so a kernel exploit still reaches you. Docker Desktop on a Mac taxes your battery. And the sandbox only exists while your laptop is open. The moment you want the agent working while you sleep, you are shopping for a server anyway.
Option 3: Cloud sandboxes built for agents
By late 2026 every sandbox provider has noticed OpenCode. E2B offers a prebuilt
opencode template. Daytona ships a plugin that runs each session in its own cloud sandbox and syncs results back as git branches. Modal publishes a worked example, Vercel a guide with a strict outbound allowlist, and Docker's new `sbx run opencode` launches the TUI in a microVM. Tensorlake takes a hybrid route: the model loop stays local and only the tool calls execute in a remote Firecracker microVM.These platforms meter by the second and are priced for bursts. That is perfect for CI jobs and parallel task fan-outs, and brutal for a sandbox that never turns off. Computed from each provider's published rates in October 2026, a standard 2 vCPU / 4 GB sandbox left running all month costs:
Provider | Published rate, 2 vCPU / 4 GB | Always-on month (730 h) |
E2B | ~$0.166/hour | ~$121 |
Daytona | ~$0.166/hour | ~$121 |
Modal (Sandbox rates) | ~$0.238/hour | ~$174 |
Agent37 | metered by the minute | $4.76 |
Free credits soften the entry: E2B gives $100 one-time on its free tier, Daytona $200, Modal $30 per month, all per their published pricing pages in October 2026. If your agent runs an hour a week, any of them is effectively free. The gap appears when the sandbox becomes a persistent computer. We keep a larger version of this comparison in our sandbox pricing breakdown, and the Agent37 pricing page tracks published rates for more than 30 providers, last checked October 1, 2026.
The always-on OpenCode sandbox: Agent37
Agent37 Cloud gives OpenCode a persistent computer instead of a disposable execution slot. One API call provisions it:
curl -X POST https://api.agent37.com/v1/instances \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{ "template": "agent37-opencode" }'The
agent37-opencode template comes with OpenCode installed and working out of the box on the managed model: no login, no account with a model provider, no keys. The first chat turn just runs, metered against your prepaid wallet. To pin a specific model instead, set OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, or OPENROUTER_API_KEY as instance env and OpenCode registers that provider at boot, billing your key rather than your wallet. You get chat, code, files, and shell on a lean image, plus a web terminal and file browser one subdomain away from the instance URL, and files, sessions, and memory persist until you delete the instance.Isolation is the core of the product. Every standard sandbox is enforced by gVisor with its own filesystem and a hard disk quota, so the agent lives behind a kernel-level boundary instead of a permission prompt. When the job needs Docker inside, a
vm instance is a full Linux virtual machine with its own kernel and KVM hardware virtualization, which means Docker runs in it (the standard gVisor type cannot run a Docker daemon). VM compute meters at 2.5x the standard rate, from $11.36 a month for the entry shape.The economics stay boring in the best way. Compute is $0.80 per vCPU, $0.70 per GB of RAM, and $0.09 per GB of disk per month, metered by the minute, so the standard 2 vCPU / 4 GB / 4 GB shape is $4.76 for a full 730-hour month. Billing stops when the instance sleeps: the same box awake an hour a day costs about $0.54 a month, and a fully sleeping one pays about $0.36 for its disk. New accounts get a $5 starter credit after adding a card, which covers just over a month of the entry sandbox.
If you want OpenCode as a personal agent rather than an API resource, the one-click personal plans host it too, including a free tier: one agent at $0, no card, that sleeps after 15 idle minutes and wakes when you message it. An always-on personal plan starts at $3.99 a month. And if you are still choosing an agent at all, our OpenCode vs OpenClaw comparison covers that decision.
Which OpenCode sandbox should you pick?
- Interactive coding on repos you trust: stay local. Tight permission config plus the opencode-sandbox wrapper plugin.
- Autonomous `--auto` sessions on your laptop: Docker with a project-only mount and an egress firewall. Start from opencode-docker.
- Burst workloads, CI, parallel task fan-outs: a per-second cloud sandbox. E2B's template or Daytona's plugin are the fastest starts.
- A persistent agent that works while you sleep: an always-on hosted sandbox. Agent37 runs OpenCode behind gVisor for $4.76 a month, or in a full VM from $11.36 when the job needs Docker. (Curious when a full VM is actually worth it? See microVM vs container.)
The pattern across all four: decide what you are protecting (your laptop, your secrets, your network) before you pick the layer that protects it.
Ready to give OpenCode a computer of its own? Spin up an OpenCode sandbox on Agent37 Cloud: one API call, gVisor isolation, from $4.76 a month, and the $5 starter credit covers your first month.
OpenCode sandbox FAQ
Does OpenCode have a built-in sandbox?
No. As of OpenCode 1.19 (October 2026) there is no sandbox feature in the config reference or docs, and the GitHub issue asking for one has been open since 2025. Isolation comes from an OS-level wrapper, a container, or a cloud sandbox that you set up around the agent.
Is opencode --auto safe to use?
Only inside isolation. The
--auto flag approves every permission request that is not explicitly denied, and deny patterns match command text, not behavior. In a sandbox with scoped files and controlled egress, --auto is how OpenCode is meant to shine. On a bare laptop it hands a fast-moving agent your whole machine.Can OpenCode run in Docker?
Yes. The official image is
ghcr.io/anomalyco/opencode. Mount a single project directory, persist ~/.local/share/opencode in a volume so logins survive restarts, and restrict outbound network if the agent will run unattended.How much does an always-on OpenCode sandbox cost?
On per-second platforms, a 2 vCPU / 4 GB sandbox running 730 hours works out to roughly $121 to $174 a month at October 2026 published rates. On Agent37 the same shape caps at $4.76 a month, about $0.54 if it is awake only an hour a day, and the managed model means it answers with zero provider accounts.
Written by
Founder at Agent37, which runs managed hosting for OpenClaw and Hermes agents for 1,000+ users. Writes about what actually breaks when you leave an AI agent running.