OpenCode 2 through Proton VPN

This Compose setup runs the OpenCode 2 beta CLI (opencode2) in the Gluetun Proton VPN network namespace. OpenCode traffic is therefore covered by Gluetun's VPN firewall instead of relying on HTTP_PROXY settings.

OpenCode 2 is currently a beta and its official documentation does not list Docker as a supported installation target. This setup installs the official V2 npm package inside a Linux container and verifies that the opencode2 binary is present during the image build.

Setup

1. Copy .env.example to .env.
2. Generate a Proton VPN WireGuard configuration for a US server from the Proton account portal.
3. Put the configuration's [Interface] PrivateKey value in .env as WIREGUARD_PRIVATE_KEY.
4. Add the provider API key needed by your OpenCode configuration to .env.
5. Set a strong OPENCODE_SERVER_PASSWORD in .env; use the same value when connecting host-side CLI clients.

The host's ~/.agents directory is mounted read-only at /root/.agents, so OpenCode can discover skills from ~/.agents/skills.

Start the VPN and opencode container:

docker compose up -d 

Open the web client at http://127.0.0.1:4096. The server and web client can access repositories beneath the mounted /repo directory. The server port is bound to localhost only; override OPENCODE_SERVER_PORT in .env if the host port is already in use.

Connect another CLI client to the running server:

opencode2 --server http://127.0.0.1:4096 /path/to/project

Set OPENCODE_SERVER_PASSWORD in the client environment before running that command.

Stop the server when finished:

docker compose stop opencode

The optional HTTP proxy is available only on the host at http://127.0.0.1:8888 by default. OpenCode itself does not need to use this proxy because its entire network namespace already belongs to Gluetun.

Verify routing

Check that the VPN is healthy:

docker compose ps
docker compose logs gluetun

Check the public address from the same network namespace as OpenCode:

docker compose run --rm --entrypoint sh opencode -lc 'curl -fsS https://ifconfig.me'

The returned address should be a Proton VPN US exit address. If Gluetun is unhealthy, the OpenCode container cannot start because of the health-gated dependency.