148 lines
3.0 KiB
JSON
148 lines
3.0 KiB
JSON
{
|
|
"meta": {
|
|
"name": "opencode-tinfoil",
|
|
"description": "OpenCode sandbox with Tinfoil enclave and LLM API access"
|
|
},
|
|
"groups": {
|
|
"include": ["deny_credentials"]
|
|
},
|
|
"commands": {
|
|
"allow": [
|
|
"git",
|
|
"node",
|
|
"npm",
|
|
"npx",
|
|
"bun",
|
|
"python3",
|
|
"python",
|
|
"pip",
|
|
"pip3",
|
|
"cargo",
|
|
"rustc",
|
|
"go",
|
|
"tinfoil"
|
|
],
|
|
"deny": [
|
|
"sudo",
|
|
"su",
|
|
"doas",
|
|
"pkexec",
|
|
"passwd",
|
|
"chsh",
|
|
"usermod",
|
|
"useradd",
|
|
"deluser",
|
|
"rm -rf /",
|
|
"mkfs",
|
|
"dd",
|
|
"fdisk",
|
|
"parted"
|
|
]
|
|
},
|
|
"workdir": {
|
|
"access": "readwrite"
|
|
},
|
|
"filesystem": {
|
|
"allow": [
|
|
"."
|
|
],
|
|
"read": [
|
|
"${HOME}/.config/opencode",
|
|
"${HOME}/.local/share/opencode",
|
|
"${HOME}/.opencode",
|
|
"${HOME}/.claude",
|
|
"${HOME}/.gitconfig",
|
|
"${HOME}/.ssh/config",
|
|
"${HOME}/.tinfoil",
|
|
"/etc/ssl",
|
|
"/etc/pki",
|
|
"/usr/share/ca-certificates",
|
|
"/usr/local/share/ca-certificates",
|
|
"/tmp"
|
|
],
|
|
"write": [
|
|
"${HOME}/.config/opencode",
|
|
"${HOME}/.local/share/opencode",
|
|
"${HOME}/.opencode",
|
|
"${HOME}/.claude",
|
|
"/tmp"
|
|
],
|
|
"deny": [
|
|
"${HOME}/.ssh/id_*",
|
|
"${HOME}/.gnupg",
|
|
"${HOME}/.aws",
|
|
"${HOME}/.azure",
|
|
"${HOME}/.gcp",
|
|
"${HOME}/.kube",
|
|
"${HOME}/.docker/config.json",
|
|
"${HOME}/.netrc",
|
|
"${HOME}/.npmrc",
|
|
"/etc/shadow",
|
|
"/etc/passwd",
|
|
"/etc/hosts"
|
|
]
|
|
},
|
|
"network": {
|
|
"block": false,
|
|
"allow_domain": [
|
|
"api.openai.com",
|
|
"api.anthropic.com",
|
|
"api.groq.com",
|
|
"api.together.xyz",
|
|
"api.openrouter.com",
|
|
"generativelanguage.googleapis.com",
|
|
"api.mistral.ai",
|
|
"api.cohere.com",
|
|
"api.x.ai",
|
|
"api.deepseek.com",
|
|
"api.perplexity.ai",
|
|
"api.gemini.google.com",
|
|
"api.fireworks.ai",
|
|
"api.replicate.com",
|
|
"api.ollama.local",
|
|
"llm.api.cloudflare.com",
|
|
"api.scaleway.ai",
|
|
"api.alibabacloud.com",
|
|
"api.moonshot.cn",
|
|
"api.minimaxi.com",
|
|
"api.stepfun.com",
|
|
"api.01.ai",
|
|
"inference.tinfoil.sh",
|
|
"*.tinfoil.sh",
|
|
"api.tinfoil.sh",
|
|
"containers.tinfoil.sh",
|
|
"ghcr.io",
|
|
"registry.npmjs.org",
|
|
"npmjs.org",
|
|
"github.com",
|
|
"raw.githubusercontent.com",
|
|
"objects.githubusercontent.com",
|
|
"huggingface.co",
|
|
"cdn.jsdelivr.net",
|
|
"unpkg.com",
|
|
"esm.sh",
|
|
"deno.land",
|
|
"crates.io",
|
|
"index.crates.io",
|
|
"static.crates.io",
|
|
"proxy.golang.org",
|
|
"sum.golang.org",
|
|
"pypi.org",
|
|
"files.pythonhosted.org",
|
|
"download.pytorch.org"
|
|
]
|
|
},
|
|
"environment": {
|
|
"set_vars": {
|
|
"OPENCODE_CONFIG_DIR": "${HOME}/.config/opencode",
|
|
"TINFOIL_CONFIG_DIR": "${HOME}/.tinfoil"
|
|
},
|
|
"deny_vars": [
|
|
"AWS_SECRET_ACCESS_KEY",
|
|
"AWS_ACCESS_KEY_ID",
|
|
"AZURE_CLIENT_SECRET",
|
|
"GCP_PRIVATE_KEY",
|
|
"KUBECONFIG"
|
|
]
|
|
}
|
|
} |