Dockerfile

# OpenCode Session Container
# Isolated environment for running OpenCode agent in headless server mode

FROM debian:bookworm-slim

# Install all system packages, languages, and tools in a single layer
# Clean up temp files in the same layer to minimize image size
RUN set -eux; \
    ARCH=$(dpkg --print-architecture); \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        bash \
        build-essential \
        ca-certificates \
        curl \
        fd-find \
        git \
        gnupg \
        jq \
        less \
        openssh-client \
        procps \
        python3 \
        python3-pip \
        python3-venv \
        ripgrep \
        sqlite3 \
        strace \
        unzip; \
    # Install Go
    curl -fsSL "https://go.dev/dl/go1.22.5.linux-${ARCH}.tar.gz" | tar -C /usr/local -xz; \
    # Install TinyGo
    curl -fsSL "https://github.com/tinygo-org/tinygo/releases/download/v0.32.0/tinygo_0.32.0_${ARCH}.deb" -o /tmp/tinygo.deb; \
    dpkg -i /tmp/tinygo.deb; \
    rm /tmp/tinygo.deb; \
    # Install Node.js 22 from NodeSource
    curl -fsSL https://deb.nodesource.com/setup_22.x | bash -; \
    apt-get install -y nodejs; \
    # Install OpenCode CLI
    npm install -g opencode-ai; \
    # Clean up
    apt-get clean; \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*; \
    npm cache clean --force; \
    # Create non-root user
    useradd -m -u 1000 -s /bin/bash opencode

ENV PATH="/usr/local/go/bin:${PATH}"

# Bake in a permissive OpenCode config for containerized headless use.
# The container is the security boundary, so all permissions are allowed.
COPY <<'EOF' /home/opencode/.config/opencode/opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "permission": "allow",
  "autoupdate": false,
  "share": "disabled"
}
EOF

RUN chown -R opencode:opencode /home/opencode/.config

USER opencode
WORKDIR /workspace

# Default: start the headless HTTP server on port 4096
EXPOSE 4096
ENTRYPOINT ["opencode"]
CMD ["serve", "--port", "4096", "--hostname", "0.0.0.0"]