AI coding agents like OpenCode are powerful because they can read files, edit code, run commands, install packages, and access the internet.
That also means you should think about what happens if the agent makes a mistake or executes something you didn't expect.
Start with OpenCode permissions
For a basic setup, use OpenCode's permission system:
{
"$schema": "https://opencode.ai/config.json",
"permission": {
"edit": "ask",
"bash": "ask",
"webfetch": "ask",
"external_directory": "deny"
}
}
This keeps OpenCode interactive instead of giving it unrestricted control.
Don't give it your entire home directory
Your home directory may contain sensitive files:
~/.ssh/
~/.aws/
~/.config/
.env
Run OpenCode from the project it actually needs instead of giving it access to your whole $HOME.
Use Bubblewrap for stronger isolation
If OpenCode needs to be more autonomous, Bubblewrap is a lightweight option available on Fedora.
Install it with:
sudo dnf install bubblewrap
Bubblewrap uses Linux namespaces to create a restricted environment around OpenCode.
The goal is to make the project accessible:
~/projects/myapp
while keeping sensitive host directories unavailable:
~/.ssh
~/.aws
~/Documents
~/other-projects
OpenCode + opencode-cwrap
Instead of maintaining a complicated bwrap command yourself, you can use opencode-cwrap, a wrapper designed to run OpenCode inside a Bubblewrap-based sandbox.
The basic workflow is:
cd ~/projects/myapp
opencode-cwrap
The idea is that OpenCode runs inside the sandbox while your current project remains available for reading and writing.
Network access can remain available so OpenCode can communicate with its model provider and Git repositories.
Before relying on the sandbox, it's worth testing what it can access:
pwd
ls
ls ~/.ssh
ls ~/.aws
The important thing to verify is that OpenCode can work with your project without being able to access sensitive files from your normal Fedora environment.
Bubblewrap is not a virtual machine. It still shares the host Linux kernel, so a VM provides a stronger isolation boundary.
Other sandboxing options
On Fedora, you have several options.
Podman can run OpenCode inside a rootless container while mounting only your project.
KVM/QEMU can run OpenCode inside a virtual machine, providing a stronger boundary between the agent and your main Fedora system.
A simple progression is:
OpenCode permissions
↓
Bubblewrap / Podman
↓
Virtual machine
Use the level of isolation appropriate for what you're doing.
What about NVIDIA OpenShell?
OpenShell is designed specifically for AI-agent environments. It adds policy controls for things like filesystem access, networking, credentials, and model access.
It's useful when you want more sophisticated agent isolation, but Fedora already provides excellent building blocks such as Podman, SELinux, Bubblewrap, and KVM/QEMU.
My approach
For normal personal projects, I'd start with OpenCode's permissions and avoid exposing sensitive directories.
For more autonomous coding, I'd use Bubblewrap with opencode-cwrap or Podman.
For untrusted code or stronger isolation, I'd use a dedicated VM.
The basic rule is simple:
Give an AI agent the minimum access it needs to do its job.
Yorumlar