bubblewrap

只读 --ro-bind SOURCE DESTINATION 读写 --bind

Example

#!/bin/bash
 
mkdir -p \
  "$HOME/.config/opencode" \
  "$HOME/.local/share/opencode" \
  "$HOME/.local/state/opencode" \
  "$HOME/.cache/opencode"
 
if [ "$PWD" = "$HOME" ]; then
    echo "Cannot run from $HOME. cd to a project specific dir and rerun"
    exit 1
fi
 
exec bwrap \
  --unshare-pid \
  --unshare-uts \
  --unshare-ipc \
  --share-net \
  --die-with-parent \
  --new-session \
  --dev-bind /dev /dev \
  --ro-bind /usr /usr \
  --ro-bind /etc /etc \
  --ro-bind /lib /lib \
  --ro-bind-try /lib64 /lib64 \
  --ro-bind-try /lib32 /lib32 \
  --symlink usr/bin /bin \
  --symlink usr/sbin /sbin \
  --ro-bind /run /run \
  --bind "$PWD" "$PWD" \
  --bind /tmp /tmp \
  --bind "$HOME/.config/opencode" "$HOME/.config/opencode" \
  --bind "$HOME/.local/share/opencode" "$HOME/.local/share/opencode" \
  --bind "$HOME/.local/state/opencode" "$HOME/.local/state/opencode" \
  --bind "$HOME/.cache/opencode" "$HOME/.cache/opencode" \
  --bind "$HOME/.agents" "$HOME/.agents" \
  --ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig" \
  --proc /proc \
  -- /usr/bin/opencode "$@"
 

Related

• Anthropic srt is based on bubblewrap