User:Pulec

it's me

opencode to local Ollama via bubblewrap

Prerequisites:

- Ollama configured and running with `Environment="OLLAMA_HOST=0.0.0.0:11434"` and some models ready, see `ollama list`,

- opencode, socat installed

sock

Create ollama.sock with 0600 access pointed at localhost 11434

socat UNIX-LISTEN:$XDG_RUNTIME_DIR/ollama.sock,fork,mode=600 TCP:127.0.0.1:11434

Template error Are you trying to use the = sign? Visit Help:Template#Escape template-breaking characters for workarounds.

opencode config

The ~/.config/opencode/opencode.json is for system opencode; for config in bubblewrap, do this:

~/.cache/agent-home/.config/opencode/opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "options": {
        "baseURL": "http://127.0.0.1:11434/v1",
        "apiKey": "ollama"
      },
      "models": {
        "gemma4:26b": { "name": "gemma4:26b", "tools": true },
        "gemma4-fit": { "name": "gemma4-fit:latest", "tools": true },
        "devstral-32k": { "name": "devstral-32k:latest", "tools": true },
        "qwen3.8:27b ": { "name": "qwen3.8:27b ", "tools": true }
      }
    }
  }
}

the first name is the important you see in ollama list, "name" is the internal 'friendly' name for opencode

bubblewrap script

test shell

$ bwrap \
    --unshare-all \
    --die-with-parent \
    --clearenv \
    --setenv HOME /home/sandbox \
    --setenv PATH /usr/local/bin:/usr/bin \
    --ro-bind /usr /usr \
    --symlink usr/bin /bin \
    --symlink usr/lib /lib \
    --symlink usr/lib /lib64 \
    --ro-bind /etc/ld.so.cache /etc/ld.so.cache \
    --ro-bind /etc/ssl /etc/ssl \
    --ro-bind /etc/ca-certificates /etc/ca-certificates \
    --ro-bind /etc/localtime /etc/localtime \
    --proc /proc \
    --dev /dev \
    --tmpfs /tmp \
    --bind ~/project /work \
    --bind ~/.cache/agent-home /home/sandbox \
    --chdir /work \
    --new-session \
    bash

Create ~/project and ~/.cache/agent-home on your filesystem or adjust accordingly

~/project will mount to the /work bwrap and ~/.cache/agent-home to /home/sandbox

opencode in bwrap with ready prompt

$ bwrap \
    --unshare-all \
    --die-with-parent \
    --clearenv \
    --setenv HOME /home/sandbox \
    --setenv PATH /usr/local/bin:/usr/bin \
    --setenv OLLAMA_API_BASE http://127.0.0.1:11434 \
    --ro-bind /usr /usr \
    --symlink usr/bin /bin \
    --symlink usr/lib /lib \
    --symlink usr/lib /lib64 \
    --ro-bind /etc/ld.so.cache /etc/ld.so.cache \
    --ro-bind /etc/ssl /etc/ssl \
    --ro-bind /etc/ca-certificates /etc/ca-certificates \
    --ro-bind /etc/localtime /etc/localtime \
    --proc /proc \
    --dev /dev \
    --tmpfs /tmp \
    --bind ~/project /work \
    --bind ~/.cache/agent-home /home/sandbox \
    --ro-bind $XDG_RUNTIME_DIR/ollama.sock /run/ollama.sock \
    --chdir /work \
    --new-session \
    sh -c 'socat TCP-LISTEN:11434,fork,reuseaddr,bind=127.0.0.1 UNIX-CONNECT:/run/ollama.sock & exec "$@"' _ \
        opencode run --model ollama/gemma4:26b "''hello world''"

Runs hello world and exits.

opencode in bwrap

$ bwrap \
    --unshare-all \
    --die-with-parent \
    --clearenv \
    --setenv HOME /home/sandbox \
    --setenv PATH /usr/local/bin:/usr/bin \
    --setenv OLLAMA_API_BASE http://127.0.0.1:11434 \
    --ro-bind /usr /usr \
    --symlink usr/bin /bin \
    --symlink usr/lib /lib \
    --symlink usr/lib /lib64 \
    --ro-bind /etc/ld.so.cache /etc/ld.so.cache \
    --ro-bind /etc/ssl /etc/ssl \
    --ro-bind /etc/ca-certificates /etc/ca-certificates \
    --ro-bind /etc/localtime /etc/localtime \
    --proc /proc \
    --dev /dev \
    --tmpfs /tmp \
    --bind ~/project /work \
    --bind ~/.cache/agent-home /home/sandbox \
    --ro-bind $XDG_RUNTIME_DIR/ollama.sock /run/ollama.sock \
    --chdir /work \
    --new-session \
    sh -c 'socat TCP-LISTEN:11434,fork,reuseaddr,bind=127.0.0.1 UNIX-CONNECT:/run/ollama.sock & exec "$@"' _ \
        opencode

On first run /connect to Ollama, enter any API key or the one you set and next run. Opencode will start in /work in the container, so ~/project on your filesystem.

Test e.g. write hello world in lua script to /work/lua and ~/project/lua/hello.lua should be created

No internet connection available, and most importantly, opencode shouldn't be able to access outside ~/project or ~/.cache/agent-home