>>108451251
this is what i do when i don't run them in lxc containers:
#!/usr/bin/bash
sandbox=~/.local/share/sandboxes/sandbox
mkdir -p $sandbox
PWD="$(realpath $PWD)"
PWDARG="--bind $PWD $PWD"
if [ "$PWD" == "$HOME" ]
then
echo PWD is HOME, not binding it
PWDARG=""
fi
bwrap \
--ro-bind /bin /bin \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /etc /etc \
--ro-bind /sbin /sbin \
--ro-bind /usr /usr \
--ro-bind /run/systemd/resolve /run/systemd/resolve \
--dev /dev \
--tmpfs /tmp \
--proc /proc \
--bind $sandbox $HOME \
$PWDARG \
--die-with-parent \
--unshare-all \
--share-net \
$@
~ master*
which opencode
opencode: aliased to sb npx opencode
anyway, no way in hell i run these without some form of isolation.