v0.7.1

Highlights

• Updated the container image to OpenCode v2.0.9.
• Added Fedora/SELinux-compatible bind mounts using private :Z labels.
• Added launcher regression coverage for SELinux mount options.
• Improved support for XDG Git configuration paths.

Security and Runtime Hardening

• Hardened the container build and runtime boundaries.
• Removed unnecessary runtime packages and capabilities.
• Preserved the read-only root filesystem, dropped capabilities, and
  no-new-privileges runtime configuration.
• Improved proxy handling without persisting proxy credentials in image layers.
• Added validation for the NodeSource signing key.
• Added file-based secret loading through /run/secrets.

Runtime Dependencies

• Updated runtime dependency collection for OpenCode v2.
• Updated npm and Context7 MCP dependencies.
• Included Git HTTP and HTTPS transport helpers.
• Improved handling of symlinked executables and shared libraries.
• Preserved shell links at /bin/sh and /usr/bin/sh.
• Removed obsolete X11 and Rust runtime dependencies.

Configuration and Documentation

• Updated OpenCode configuration and TUI configuration for v2.
• Updated build and manual-run examples to OpenCode v2.0.9.
• Documented SELinux bind-mount behavior.
• Updated container usage and security documentation.

Testing and CI

• Expanded bootstrap tests.
• Expanded runtime dependency collector tests.
• Added custom CA build verification.
• Added launcher regression tests.
• Added GitHub Actions coverage for the complete test and release pipeline.

Fixes

• Corrected the runtime dependency regression test.
• Removed the expectation for the nonexistent Debian Git helper
  git-remote-curl.
• Continued validating git-remote-http and git-remote-https.

v0.6.4

This release contains the complete v0.6.0 feature set, along with several follow-up fixes that make the distroless image build reliably with Docker BuildKit and Podman.

Breaking Changes

• Removed Xvfb and virtual display support.
• Removed the DISPLAY=:99.0 environment variable.
• Graphical applications that depend on the bundled X server are no longer supported.
• Added a minimal POSIX /bin/sh to the distroless runtime. This is required by OpenCode's shell tool and npm lifecycle scripts.

Features

• Added custom CA certificate support through custom-ca.crt.
• Configured npm to use the system CA bundle, including custom certificates.
• Added HTTP, HTTPS, and NO_PROXY forwarding during image builds and runtime.
• Added the DCP TUI plugin configuration.
• Added runtime collector validation for the POSIX shell and custom CA certificates.
• Preserved the distroless runtime's minimal security model while supporting shell execution.

Fixes

• Fixed BuildKit and Podman failures when copying the collected runtime filesystem into the distroless image.
• Preserved the base image's /bin, /sbin, /lib, and /lib64 symlinks.
• Merged collected runtime files into the corresponding /usr paths instead of exporting conflicting top-level directories.
• Replaced incomplete chroot validation with validation of the collected shell executable and symlink target.
• Preserved runtime shared-library paths after filesystem assembly.
• Fixed make prune-cache deleting tagged images.

Updates

• OpenCode 1.18.25 -> 1.18.30
• Context7 MCP 4.0.4 -> 4.0.6
• Updated pinned GitHub Actions and git-cliff dependencies.

Upgrade Notes

Existing users who want the latest TUI configuration should run:

opencode-container --update-config

Users behind a corporate proxy can export the following variables before building:

export HTTP_PROXY=http://proxy.example:3128
export HTTPS_PROXY=$HTTP_PROXY
export NO_PROXY=localhost,127.0.0.1
make build

Corporate CA certificates should be placed in custom-ca.crt at the build-context root before running make build.

Container Image

Pull the released image with:

docker pull ghcr.io/pkhamre/opencode-container:v0.6.4

The latest tag is also updated by the release workflow.

Full Changelog: v0.5.0...v0.6.4

v0.5.0

Breaking changes / migration from v0.4.0

The project is renamed from opencode-docker to opencode-container (engine-agnostic: Docker or Podman).

• bin/opencode-docker is now bin/opencode-container — update your PATH
• Image tag is now opencode-container:latest. Retag a locally built image once:
  docker tag opencode-docker:latest opencode-container:latest (same for podman), or just run make build
• State dir auto-migrates on first run: ~/.opencode-docker → ~/.opencode-container — sessions, auth, and secrets carry over; no action needed
• If pulling from GHCR: the image is now ghcr.io/pkhamre/opencode-container. Old ghcr.io/pkhamre/opencode-docker pulls keep working but no longer receive updates

Chores

• bump pinned dependency versions to latest

• flag breaking changes in generated release notes

• Bundled OpenCode bumped to 1.18.25; base images and context7-mcp re-pinned to the latest versions.

Documentation

• rename project to opencode-container

Features

• add engine-agnostic bin/opencode-container launcher

v0.4.0

Features

• add --host-access flag for reaching host services

Refactoring

• harden bootstrap, launcher, and runtime dep collection

v0.3.1

Bug Fixes

• prevent runtime dep nesting with cp -aT

Chores

• bump pinned dependency versions to latest

v0.3.0

Bug Fixes

• centralize secret loading in bootstrap

• make bootstrap display startup observable

• harden runtime dependency collection

• use absolute path for true in runtime collector test

CI

• generate structured release notes with git-cliff

• locate git-cliff binary regardless of archive layout

• scope git-cliff extraction to its own directory

Chores

• add prune-cache target to Makefile

• add GitHub release workflow with GHCR publishing

Documentation

• make llm output concise answers.

Refactoring

• remove duplicate development launcher

v0.2.5

Fixes

• Pass opencode subcommands and -m/-c flags through the wrapper
• Move config copy after option parsing so -u/--update-config works

Features

• Add --secrets env-file to docker run; switch context7 MCP to remote

Chores

• Bump opencode to 1.18.11, context7-mcp to 3.2.5, superpowers to v6.2.0
• Enable yolo mode; plugin and env-var fixes
• Simplify scripts (shrink collect-runtime-deps.sh)

Docs

• README rewrite + hero SVG, AGENTS.md updates

v0.2.4

Added

• -u / --update-config flag to bin/opencode-docker — overwrites ~/.opencode-docker/config/ files with the repo versions
• rustc and cargo to the Docker builder stage and runtime rootfs

Changed

• OpenCode bumped from 1.15.12 → 1.17.7
• @upstash/context7-mcp bumped from 1.0.17 → 3.2.1 (Dockerfile and config/opencode.json)
• superpowers plugin ref pinned from commit SHA → tag #v6.0.2
• Debian slim base image digest updated
• Star History chart in README now uses theme-aware <picture> element

Full Changelog: v0.2.3...v0.2.4

v0.2.3

Security

• Pin OpenCode installer script with SHA256 checksum verification
• Pin debian:13-slim base image to SHA256 digest
• Pin npm packages to exact versions (@upstash/context7-mcp@1.0.17)
• Pin plugins to exact versions/commits (superpowers to commit SHA, @tarquinen/opencode-dcp@3.1.12)

Removed

• Remove sequential-thinking MCP server
• Remove brainstorm port functionality (-b/--brainstorm flag, BRAINSTORM_PORT, BRAINSTORM_HOST)

Full Changelog: v0.2.2...v0.2.3

v0.2.2

Features

• Add -m/--memory and -c /--cpus flags with 4g/4cpu defaults
• Add ripgrep and jq to distroless image
• Add OPENCODE_VERSION build arg for cache busting

Improvements

• Upgrade base images from Debian 12 to Debian 13
• Harden PATH by removing /bin, restructuring bin to usr/bin symlinks
• Unpin opencode-dcp plugin version
• Add commit message conventions to AGENTS.md

Full Changelog: v0.2.1...v0.2.2