Run OpenCode in a Tensorlake Sandbox

OpenCode is one of the most-followed open source terminal coding agents, and its whole appeal is autonomy: it will scan a repository, refactor a service, and run whatever shell commands the task needs. That autonomy is also the problem. By default, every one of those commands runs on the machine you launched it from.

The tensorlake-opencode plugin fixes this with a clean split: the brain stays local, the hands go into a sandbox.

How the integration works

OpenCode keeps running on your machine. The TUI, the model loop, and your session never move. The plugin intercepts only the tool calls and routes them into a Tensorlake sandbox, a Firecracker microVM with its own kernel:

• bash runs as a shell command inside the sandbox.
• read, write, and edit operate on the sandbox filesystem.
• ls, glob, and grep search the sandbox, not your laptop.

webfetch and websearch are not intercepted. They stay local because they never touch your filesystem.

The sandbox is created lazily on the first tool call, so startup costs you nothing until the agent actually does something. Sandboxes are named and persisted, so a session reconnects to its sandbox across OpenCode restarts. A suspended sandbox resumes with the workspace, installed dependencies, and warm caches intact.

Setup

Add the plugin to ~/.config/opencode/opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["tensorlake-opencode"]
}

OpenCode treats bare names as npm packages and installs them into its own cache. You never run npm install yourself.

Then export your API key in the shell you launch OpenCode from and start it as usual:

export TENSORLAKE_API_KEY=your_api_key_here
opencode

That is the whole setup. From the first bash or write call onward, the agent is operating inside a disposable environment. A bad command, a runaway install, or a stray rm lands in the microVM, not in your working tree.

Why a sandbox instead of your laptop

• Isolation. The agent's shell and file tools never touch the host. You can let OpenCode run with fewer permission prompts because the blast radius is a disposable VM.
• Reproducible environments. Every session gets the same image, CPU, and memory regardless of what is installed on the developer's machine. Pin a custom image with the right toolchain once and every session inherits it.
• State that survives restarts. Suspend and resume means the sandbox picks up where it left off, without re-cloning the repo or re-installing dependencies.

The full setup guide, including custom images and Personal Access Token configuration, is in the OpenCode integration docs. If you are evaluating OpenCode itself, our comparison with Claude Code covers where each harness fits.