adding opencode to the environment

.gitignore

@@ -44,3 +44,6 @@ Thumbs.db
 *.zip
 *.sas7bdat
 *.parquet
+
+
+.opencode-sandbox/.env

.opencode-sandbox/Dockerfile

@@ -0,0 +1,19 @@
+FROM archlinux:latest
+
+# Network restriction — only allow git.processhub.work
+RUN pacman -Syu --noconfirm && \
+    pacman -S --noconfirm \
+      nodejs \
+      npm \
+      git \
+      iptables \
+      opencode \
+    && pacman -Scc --noconfirm
+
+# Firewall script — blocks everything except your Gitea instance
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+WORKDIR /workspace
+
+ENTRYPOINT ["/entrypoint.sh"]

.opencode-sandbox/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  opencode:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: opencode-sandbox
+    container_name: opencode
+    cap_add:
+      - NET_ADMIN   # required for iptables in entrypoint
+      - NET_RAW
+    volumes:
+      # Your monorepo — opencode's working directory
+      - ../:/workspace
+      # Persist opencode auth so you don't re-login every time
+      - opencode-auth:/root/.local/share/opencode
+    environment:
+      - OPENCODE_API_KEY=${OPENCODE_API_KEY}
+    stdin_open: true
+    tty: true
+    working_dir: /workspace
+
+volumes:
+  opencode-auth:

.opencode-sandbox/entrypoint.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+exec opencode