66 lines
1.3 KiB
Markdown
66 lines
1.3 KiB
Markdown
# nono-opencode-tinfoil
|
|
|
|
A [`nono`](https://github.com/guybedford/nono) sandbox profile for running
|
|
[OpenCode](https://opencode.ai) with access to [Tinfoil](https://tinfoil.sh)
|
|
enclaves and other LLM providers.
|
|
|
|
## Install
|
|
|
|
### macOS / Linux
|
|
|
|
```bash
|
|
git clone https://github.com/YOUR_USERNAME/nono-opencode-tinfoil.git
|
|
cd nono-opencode-tinfoil
|
|
make install
|
|
```
|
|
|
|
This installs the profile to `~/.config/nono/profiles/` and a wrapper script
|
|
to `~/.local/bin/`.
|
|
|
|
### Requirements
|
|
|
|
- [nono](https://github.com/guybedford/nono) installed
|
|
- `opencode` installed globally (e.g. `npm i -g opencode-ai`)
|
|
|
|
## Usage
|
|
|
|
After install, run OpenCode from any project directory:
|
|
|
|
```bash
|
|
opencode
|
|
```
|
|
|
|
Or use the profile directly:
|
|
|
|
```bash
|
|
nono run --profile opencode-tinfoil --allow-cwd -- opencode
|
|
```
|
|
|
|
## Tinfoil integration
|
|
|
|
The profile allows network access to:
|
|
|
|
- `*.tinfoil.sh`
|
|
- `inference.tinfoil.sh`
|
|
- `containers.tinfoil.sh`
|
|
- `ghcr.io`
|
|
|
|
and grants read/write access to `~/.tinfoil` for Tinfoil credentials.
|
|
|
|
## Security model
|
|
|
|
- Current working directory: read/write
|
|
- OpenCode config: read/write
|
|
- Tinfoil config: read/write
|
|
- SSH private keys, AWS/GCP/Azure credentials, kubeconfig: denied
|
|
- `sudo`, `su`, `doas`, `passwd`, disk tools: denied
|
|
|
|
## Uninstall
|
|
|
|
```bash
|
|
make uninstall
|
|
```
|
|
|
|
## License
|
|
|
|
MIT |