jrozanski/opencode-sandbox
Archived
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use Opencode V2

Browse source
This commit is contained in:
Jarek Rozanski 2026-10-10 17:21:37 +02:00
commit b1f89eef85
No known key found for this signature in database
2 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Containerfile
View file

@ -1,5 +1,5 @@
# OpenCode dev sandbox: rootless-Podman container with JDK 25, Node 24, Go, # OpenCode dev sandbox: rootless-Podman container with JDK 25, Node 24, Go,
# Rust, pnpm, git, curl, and a hash-pinned build of OpenCode # Rust, pnpm, git, curl, and a hash-pinned build of OpenCode v2
# (github.com/anomalyco/opencode). # (github.com/anomalyco/opencode).
# #
# Built as multi-stage: JDK, Node, Go, and Rust toolchains are pulled from # Built as multi-stage: JDK, Node, Go, and Rust toolchains are pulled from
@ -67,12 +67,16 @@ ARG TARGETARCH
# OpenCode version + per-arch SHA256 pins. Re-verified by hand against the # OpenCode version + per-arch SHA256 pins. Re-verified by hand against the
# actual release assets (curl + sha256sum), not just copied from a summary: # actual release assets (curl + sha256sum), not just copied from a summary:
# curl -fsSL -o oc.tar.gz https://github.com/anomalyco/opencode/releases/download/v<ver>/opencode-linux-<x64|arm64>.tar.gz # curl -fsSL -o oc.tar.gz https://opencode.ai/files/bin/<ver>/opencode-linux-<x64|arm64>.tar.gz
# sha256sum oc.tar.gz # sha256sum oc.tar.gz
# Re-run this whenever OPENCODE_VERSION is bumped, and update the two hashes. # Re-run this whenever OPENCODE_VERSION is bumped, and update the two hashes.
ARG OPENCODE_VERSION=1.18.32 # Why not the official ghcr.io/anomalyco/opencode:<ver> image: it is Alpine
ARG OPENCODE_SHA256_AMD64=3046e0404fdc60fb80307e7a47824ba07477364178a4d09baa8548496dd6d43b # (musl), so its binary can't be copied into this glibc Debian stage. The
ARG OPENCODE_SHA256_ARM64=568461b7d4d8c19865c97e9a1102e613049c6039d01fe772154de873c1865840 # glibc tarball below is the same release, served from opencode.ai (v2
# releases are not attached to GitHub Releases, unlike v1).
ARG OPENCODE_VERSION=2.0.26
ARG OPENCODE_SHA256_AMD64=6d94dde0ac1b009327189772f5e242e13f7f7916a4fcd58bf39f9c15d6a517d1
ARG OPENCODE_SHA256_ARM64=1508f9cc9a519b2aac93439d171a0be554ffe5a2cf433405010ec664663a7eae
# pnpm version, installed via pnpm's own standalone script (not Corepack -- # pnpm version, installed via pnpm's own standalone script (not Corepack --
# the pnpm team doesn't recommend Corepack, and Node 25+ dropped bundling it). # the pnpm team doesn't recommend Corepack, and Node 25+ dropped bundling it).
@ -260,7 +264,7 @@ RUN set -eu; \
*) echo "ERROR: unsupported TARGETARCH='$TARGETARCH'" >&2; exit 1 ;; \ *) echo "ERROR: unsupported TARGETARCH='$TARGETARCH'" >&2; exit 1 ;; \
esac; \ esac; \
curl -fsSL -o /tmp/opencode.tar.gz \ curl -fsSL -o /tmp/opencode.tar.gz \
"https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/opencode-linux-${OC_ARCH}.tar.gz"; \ "https://opencode.ai/files/bin/${OPENCODE_VERSION}/opencode-linux-${OC_ARCH}.tar.gz"; \
printf '%s /tmp/opencode.tar.gz\n' "$OC_SHA256" | sha256sum -c -; \ printf '%s /tmp/opencode.tar.gz\n' "$OC_SHA256" | sha256sum -c -; \
mkdir -p /tmp/opencode-extract; \ mkdir -p /tmp/opencode-extract; \
tar -xzf /tmp/opencode.tar.gz -C /tmp/opencode-extract; \ tar -xzf /tmp/opencode.tar.gz -C /tmp/opencode-extract; \
@ -276,7 +280,7 @@ RUN { ldd /usr/local/bin/opencode || true; } | tee /tmp/opencode-ldd.txt && \
rm -f /tmp/opencode-ldd.txt rm -f /tmp/opencode-ldd.txt
# jdtls/kotlin-lsp aren't invoked here (both block waiting on stdio LSP # jdtls/kotlin-lsp aren't invoked here (both block waiting on stdio LSP
# input with no --version-style flag) -- just checked for presence instead. # input with no --version-style flag) -- just checked for presence instead.
RUN java -version && node --version && pnpm --version && git --version && curl --version && \ RUN opencode --version && java -version && node --version && pnpm --version && git --version && curl --version && \
go version && rustc --version && rust-analyzer --version && gopls version && \ go version && rustc --version && rust-analyzer --version && gopls version && \
tsc --version && typescript-language-server --version && \ tsc --version && typescript-language-server --version && \
test -x /usr/local/bin/jdtls && \ test -x /usr/local/bin/jdtls && \

2
README.md
View file

@ -70,7 +70,7 @@ Bumping a pinned LSP version means editing the corresponding `ARG`/`FROM` tag in
**Containerfile** — multi-stage build on `debian:trixie-slim`: **Containerfile** — multi-stage build on `debian:trixie-slim`:
- JDK and Node are copied in from their official upstream images (`eclipse-temurin:25-jdk-noble`, `node:24-trixie-slim`) rather than apt-installed, keeping the final image slim while staying on a mainstream glibc distro (Alpine/musl is avoided — it breaks JVM and native Node addon compatibility). - JDK and Node are copied in from their official upstream images (`eclipse-temurin:25-jdk-noble`, `node:24-trixie-slim`) rather than apt-installed, keeping the final image slim while staying on a mainstream glibc distro (Alpine/musl is avoided — it breaks JVM and native Node addon compatibility).
- pnpm is installed via its own standalone installer script, pinned to a specific version. - pnpm is installed via its own standalone installer script, pinned to a specific version.
- OpenCode is downloaded directly from its canonical GitHub releases (`github.com/anomalyco/opencode`) for the container's architecture, and its SHA256 is checked against a hash pinned in the Containerfile before it's installed — there's no maintainer-published signature for OpenCode releases, so this hash is captured by hand and is the actual root of trust here. Bump `OPENCODE_VERSION` and re-run the `sha256sum` steps documented in the Containerfile's comments whenever you upgrade it. - OpenCode v2 is downloaded directly from its official download host (`opencode.ai/files/bin`, the glibc build of v2) for the container's architecture, and its SHA256 is checked against a hash pinned in the Containerfile before it's installed — there's no maintainer-published signature for OpenCode releases, so this hash is captured by hand and is the actual root of trust here. Bump `OPENCODE_VERSION` and re-run the `sha256sum` steps documented in the Containerfile's comments whenever you upgrade it.
- A few build-time smoke tests (`ldd`, `java -version`, `node --version`, etc.) fail the build immediately if anything is broken, rather than surfacing at first `make opencode`. - A few build-time smoke tests (`ldd`, `java -version`, `node --version`, etc.) fail the build immediately if anything is broken, rather than surfacing at first `make opencode`.
**Makefile** — four targets: **Makefile** — four targets: