soc: a bubblewrap script to isolate opencode

1 files changed, 27 insertions, 0 deletions

diff --git a/soc b/soc
new file mode 100755
index 0000000..b47d31e
--- /dev/null
+++ b/soc
@@ -0,0 +1,27 @@
+#!/usr/bin/env sh
+
+bwrap \
+  --ro-bind /usr /usr \
+  --ro-bind /lib /lib \
+  --ro-bind /lib64 /lib64 \
+  --ro-bind /bin /bin \
+  --ro-bind /etc/ssl /etc/ssl \
+  --ro-bind /etc/ca-certificates /etc/ca-certificates \
+  --ro-bind /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf \
+  --dev /dev \
+  --proc /proc \
+  --tmpfs /home/$(whoami) \
+  --tmpfs /tmp \
+  --bind ~/.config/opencode /home/$(whoami)/.config/opencode \
+  --bind ~/.local/state/opencode /home/$(whoami)/.local/state/opencode \
+  --bind ~/.local/share/opencode /home/$(whoami)/.local/share/opencode \
+  --bind ~/.cache/uv /home/$(whoami)/.cache/uv \
+  --bind ~/.cache/huggingface /home/$(whoami)/.cache/huggingface \
+  --bind ~/.cache/opencode /home/$(whoami)/.cache/opencode \
+  --bind ~/code/workspace /home/$(whoami)/project \
+  --clearenv \
+  --setenv HOME /home/$(whoami) \
+  --setenv USER $(whoami) \
+  --setenv SHELL /bin/bash \
+  --chdir /home/$(whoami)/project \
+  bash