sha256:dc06c66054bb0abbda2076f5102e5fe03d03a963736780dfc62333e1fecb1d12
Last pushed
2 days by domboeckli
Type
Sandbox Kit
Manifest digest
sha256:dc06c66054bb0abbda2076f5102e5fe03d03a963736780dfc62333e1fecb1d12
schemaVersion: "3"
displayName: OpenCode (v3)
description: OpenCode with the kit tooling, MCP gateway wiring, plugins and proxy-managed provider credentials.
kind: workload
provides:
- deb/[email protected]
- deb/[email protected]
- deb/base-files@14
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/ca-certificates-java@20260311
- deb/ca-certificates@20260816
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/gcc-16-base@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/less@668
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libasan8@16
- deb/[email protected]
- deb/libatomic1@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libcc1-0@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libgcc-s1@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libgomp1@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libhwasan0@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libitm1@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libjpeg8@8
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/liblsan0@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libquadmath0@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libstdc++6@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/libtsan2@16
- deb/libubsan1@16
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/lto-disabled-list@79
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/tzdata@2026
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
capabilities:
- type: com.docker.sandbox/sbx@1
- type: com.docker.sandbox/network-policy@1
config:
install:
allow:
- githubstatus.com
- www.githubstatus.com
- azure.status.microsoft
- status.azure.com
- status.docker.com
- dockerstatus.com
- www.dockerstatus.com
- status.maven.org
- status.sonatype.com
- status.npmjs.org
- status.python.org
- cloudflarestatus.com
- www.cloudflarestatus.com
- status.codeberg.org
- opencode.ai
- '*.opencode.ai'
- context7.com
- '*.context7.com'
- docs.mistral.ai
- api.mistral.ai
- api.eu.mistral.ai
- api.deepseek.com
- '*.deepseek.com'
- openrouter.ai
- '*.openrouter.ai'
- api.z.ai
- '*.z.ai'
- generativelanguage.googleapis.com
- openai.com
- '*.openai.com'
- anthropic.com
- api.anthropic.com
- '*.anthropic.com'
- platform.claude.com
- github.com
- api.github.com
- '*.github.com'
- codeberg.org
- '*.codeberg.org'
- maven.pkg.github.com
- githubusercontent.com
- objects.githubusercontent.com
- '*.githubusercontent.com'
- models.dev
- registry.npmjs.org
- nodejs.org
- dlcdn.apache.org
- archive.apache.org
- camel.apache.org
- '*.camel.apache.org'
- jetbrains.com
- www.jetbrains.com
- plugins.jetbrains.com
- youtrack.jetbrains.com
- localhost:9200
- 127.0.0.1:9200
- host.docker.internal:9200
- localhost:5601
- 127.0.0.1:5601
- host.docker.internal:5601
- localhost:8200
- 127.0.0.1:8200
- host.docker.internal:8200
- localhost:30920
- 127.0.0.1:30920
- localhost:30561
- 127.0.0.1:30561
- localhost:30820
- 127.0.0.1:30820
- maven.org
- repo1.maven.org
- '*.maven.org'
- spring.io
- repo.spring.io
- '*.spring.io'
- start.spring.io
- docker.io
- '*.docker.io'
- docker.com
- '*.docker.com'
- download.docker.com
- dl.k8s.io
- get.helm.sh
- docker.elastic.co
- docker-auth.elastic.co
- cr.jaegertracing.io
- ghcr.io
- repo.repsy.io
- jitpack.io
- artifacts.cibseven.org
- packages.scm-manager.org
- api.cloudsmith.io
- upload.cloudsmith.io
- docker.cloudsmith.io
- helm.oci.cloudsmith.io
- dl.cloudsmith.io
- docs.cloudsmith.com
- cloudsmith.com
- www.cloudsmith.com
- '**/*.r2.cloudflarestorage.com'
- api.bell-sw.com
- archive.ubuntu.com
- security.ubuntu.com
- ports.ubuntu.com
- repo.mongodb.org
- pypi.org
- files.pythonhosted.org
- add-skill.vercel.sh
- www.skills.sh
- '*.exa.ai'
- api.stackexchange.com
- sonarcloud.io
- '*.sonarcloud.io'
- api.deepseek.com:443
- api.mistral.ai:443
- api.z.ai:443
- context7.com:443
- api.stackexchange.com:443
- api.cloudsmith.io:443
- upload.cloudsmith.io:443
- maven.pkg.github.com:443
- sonarcloud.io:443
- codeberg.org:443
- api.github.com:443
- github.com:443
- openrouter.ai:443
- generativelanguage.googleapis.com:443
runtime:
allow:
- githubstatus.com
- www.githubstatus.com
- azure.status.microsoft
- status.azure.com
- status.docker.com
- dockerstatus.com
- www.dockerstatus.com
- status.maven.org
- status.sonatype.com
- status.npmjs.org
- status.python.org
- cloudflarestatus.com
- www.cloudflarestatus.com
- status.codeberg.org
- opencode.ai
- '*.opencode.ai'
- context7.com
- '*.context7.com'
- docs.mistral.ai
- api.mistral.ai
- api.eu.mistral.ai
- api.deepseek.com
- '*.deepseek.com'
- openrouter.ai
- '*.openrouter.ai'
- api.z.ai
- '*.z.ai'
- generativelanguage.googleapis.com
- openai.com
- '*.openai.com'
- anthropic.com
- api.anthropic.com
- '*.anthropic.com'
- platform.claude.com
- github.com
- api.github.com
- '*.github.com'
- codeberg.org
- '*.codeberg.org'
- maven.pkg.github.com
- githubusercontent.com
- objects.githubusercontent.com
- '*.githubusercontent.com'
- models.dev
- registry.npmjs.org
- nodejs.org
- dlcdn.apache.org
- archive.apache.org
- camel.apache.org
- '*.camel.apache.org'
- jetbrains.com
- www.jetbrains.com
- plugins.jetbrains.com
- youtrack.jetbrains.com
- localhost:9200
- 127.0.0.1:9200
- host.docker.internal:9200
- localhost:5601
- 127.0.0.1:5601
- host.docker.internal:5601
- localhost:8200
- 127.0.0.1:8200
- host.docker.internal:8200
- localhost:30920
- 127.0.0.1:30920
- localhost:30561
- 127.0.0.1:30561
- localhost:30820
- 127.0.0.1:30820
- maven.org
- repo1.maven.org
- '*.maven.org'
- spring.io
- repo.spring.io
- '*.spring.io'
- start.spring.io
- docker.io
- '*.docker.io'
- docker.com
- '*.docker.com'
- download.docker.com
- dl.k8s.io
- get.helm.sh
- docker.elastic.co
- docker-auth.elastic.co
- cr.jaegertracing.io
- ghcr.io
- repo.repsy.io
- jitpack.io
- artifacts.cibseven.org
- packages.scm-manager.org
- api.cloudsmith.io
- upload.cloudsmith.io
- docker.cloudsmith.io
- helm.oci.cloudsmith.io
- dl.cloudsmith.io
- docs.cloudsmith.com
- cloudsmith.com
- www.cloudsmith.com
- '**/*.r2.cloudflarestorage.com'
- api.bell-sw.com
- archive.ubuntu.com
- security.ubuntu.com
- ports.ubuntu.com
- repo.mongodb.org
- pypi.org
- files.pythonhosted.org
- add-skill.vercel.sh
- www.skills.sh
- '*.exa.ai'
- api.stackexchange.com
- sonarcloud.io
- '*.sonarcloud.io'
- api.deepseek.com:443
- api.mistral.ai:443
- api.z.ai:443
- context7.com:443
- api.stackexchange.com:443
- api.cloudsmith.io:443
- upload.cloudsmith.io:443
- maven.pkg.github.com:443
- sonarcloud.io:443
- codeberg.org:443
- api.github.com:443
- github.com:443
- openrouter.ai:443
- generativelanguage.googleapis.com:443
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.deepseek.com
format: Bearer %s
header: Authorization
name: DEEPSEEK_API_KEY
proxyManaged: true
phase: runtime
service: deepseek
description: DeepSeek API-Key (https://platform.deepseek.com/api_keys)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.mistral.ai
format: Bearer %s
header: Authorization
name: MISTRAL_API_KEY
proxyManaged: true
phase: runtime
service: mistral
description: Mistral API-Key (https://console.mistral.ai/)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.z.ai
format: Bearer %s
header: Authorization
name: ZAI_API_KEY
proxyManaged: true
phase: runtime
service: zai
description: Z.AI API-Key (https://z.ai/manage-apikey/apikey-list)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: openrouter.ai
format: Bearer %s
header: Authorization
name: OPENROUTER_API_KEY
proxyManaged: true
phase: runtime
service: openrouter
description: OpenRouter API-Key (https://openrouter.ai/keys)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: generativelanguage.googleapis.com
format: '%s'
header: x-goog-api-key
name: GOOGLE_GENERATIVE_AI_API_KEY
proxyManaged: true
phase: runtime
service: google
description: Google Gemini API-Key (https://aistudio.google.com/apikey)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.github.com
format: Bearer %s
header: Authorization
- domain: github.com
format: Bearer %s
header: Authorization
name: GH_TOKEN
proxyManaged: true
phase: runtime
service: github
description: GitHub (gh/git) — proxy-managed token
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: context7.com
format: Bearer %s
header: Authorization
name: CONTEXT7_API_KEY
proxyManaged: true
phase: runtime
service: context7
description: Context7 API-Key (https://context7.com/dashboard)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.stackexchange.com
format: Bearer %s
header: Authorization
name: STACKOVERFLOW_API_KEY
proxyManaged: true
phase: runtime
service: stackoverflow
description: Stack Overflow API-Key (https://stackapps.com/applications)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.cloudsmith.io
format: '%s'
header: X-Api-Key
- domain: upload.cloudsmith.io
format: '%s'
header: X-Api-Key
name: CLOUDSMITH_API_KEY
proxyManaged: true
phase: runtime
service: cloudsmith
description: Cloudsmith API-Key (https://cloudsmith.io/user/settings/api-keys/)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: maven.pkg.github.com
format: Bearer %s
header: Authorization
name: GITHUB_MAVEN_TOKEN
proxyManaged: true
phase: runtime
service: github-maven
description: GitHub Packages Maven — klassisches PAT (nur read:packages)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: sonarcloud.io
format: Bearer %s
header: Authorization
name: SONAR_TOKEN
proxyManaged: true
phase: runtime
service: sonarcloud
description: SonarCloud API-Token (https://sonarcloud.io/account/security)
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: codeberg.org
format: token %s
header: Authorization
name: CODEBERG_TOKEN
proxyManaged: true
phase: runtime
service: codeberg
description: Codeberg API-Token (https://codeberg.org/user/settings/applications)
- type: com.docker.sandbox/agent-context@1
optional: true
config:
contentFile: /usr/share/sandbox/kit/opencode-v3-agent/context.md
directory: /home/agent/.config/opencode
filename: AGENTS.md
- type: com.docker.sandbox/lifecycle@1
config:
startup:
- command: bash /home/agent/.local/bin/opencode-startup-ca.sh
description: Import the sandbox proxy CA into the JDK cacerts (Maven trust)
env:
- PROXY_CA_CERT_B64
- JAVA_HOME
user: "0"
- command: bash /home/agent/.local/bin/opencode-startup-maven.sh
description: Write ~/.m2/settings.xml with proxy routing, github-maven and host-cache profile
env:
- GITHUB_MAVEN_TOKEN
- HOME
user: "1000"
dockerfile: ./opencode-v3-agent.dockerfile