This is what I have been using with opencode: exec bwrap \ --unshare-pid \ --unshare-ipc \ --unshare-uts \ --share-net \ --bind "$OPENCOD

This is what I have been using with opencode: exec bwrap \ --unshare-pid \ --unshare-ipc \ --unshare-uts \ --share-net \ --bind "$OPENCODE_ROOT" "$OPENCODE_ROOT" \ --bind "$CURRENT_DIR" "$CURRENT_DIR" \ --bind "$HOME/.config/opencode/" "$HOME/.config/opencode/" \ --bind "$HOME/.emacs" "$HOME/.emacs" \ --bind "$HOME/.emacs.d" "$HOME/.emacs.d" \ --ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig" \ --ro-bind /bin /bin \ --ro-bind /etc /etc \ --ro-bind /lib /lib \ --ro-bind /lib64 /lib64 \ --ro-bind /usr /usr \ --bind /run/systemd /run/systemd \ --tmpfs /tmp \ --proc /proc \ --dev /dev \ --setenv EDITOR emacs \ --setenv PATH "$OPENCODE_BINDIR:/usr/bin:/bin" \ --setenv HOME "$HOME" \ -- \ "opencode" "$@"