OpenCode with Hetzner Experiments Inference API + systemd-Sandbox

Introduction

OpenCode is an AI-powered coding agent for the terminal. Unlike traditional chatbots, OpenCode works directly with a software project. It can read and edit files, analyze code, suggest changes, run tests, and work with Git repositories.
This capability lets it support the entire development process without requiring users to copy code into a chat window, since it can operate directly within the local development environment.

Typical alternatives or comparable tools include, for example:

• GitHub Copilot
• Cursor
• Claude Code
• Aider

Unlike many built-in AI assistants, OpenCode is not tied to a specific IDE or model provider.

Why the Hetzner Experiments Inference API?

OpenCode itself does not provide a language model. Instead, it connects to a compatible LLM provider.
In this tutorial, we’ll use the Hetzner Experiments Inference API.

Advantages:

• European provider
• OpenAI-compatible API
• No local GPU required
• Works directly with OpenCode

Why a sandbox?

A coding agent has more privileges than a normal chatbot. It can modify files, execute local commands, and launch development tools.
This is convenient, but it also poses a security risk.

The sandbox restricts OpenCode’s access to:

• the current Git repository
• the necessary OpenCode configuration and cache directories

The sandbox hides the rest of the home directory.

Prerequisites

This tutorial requires:

• Linux with systemd (e.g., Ubuntu, Debian, Fedora, Arch Linux)
• a working user session for systemd --user
• a Git repository
• a shell with access to ~/.bashrc

Step 1 - Install OpenCode

Install OpenCode, for example, as follows:

curl -fsSL https://opencode.ai/install | bash

Or use another installation method:

https://opencode.ai/docs#install

If your current shell has not yet recognized the installation path, reload the shell configuration:

source ~/.bashrc

Alternatively, open a new terminal.

Then check where the OpenCode binary is located:

which opencode

Example (the path may vary depending on the installation method):

/home/<user>/.opencode/bin/opencode

You’ll need this path later in the wrapper script.

Step 2 - Create an API key

• Log in at https://experiments.hetzner.com.
• Under APPS on the left, select "Inference."
• Then click the "Create API Token" button in the top-right corner.

Step 3 - Set the API key as an environment variable

echo 'export HETZNER_VLLM_API_KEY="<insert-your-token-here>"' >> ~/.bashrc
source ~/.bashrc

Check if the variable has been set:

echo "$HETZNER_VLLM_API_KEY"

Step 4 - Configure OpenCode

mkdir -p ~/.config/opencode
vim ~/.config/opencode/opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "hetzner": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Hetzner",
      "options": {
        "baseURL": "https://inference.hetzner.com/api/v1",
        "apiKey": "{env:HETZNER_VLLM_API_KEY}"
      },
      "models": {
        "Qwen/Qwen3.6-35B-A3B-FP8": {
          "name": "Qwen3.6-35B-A3B-FP8"
        }
      }
    }
  },
  "model": "hetzner/Qwen/Qwen3.6-35B-A3B-FP8"
}

Step 5 - Start OpenCode

Now you can start opencode directly or continue with the sandbox setup if you want to use opencode securely within a project. In step 11, you’ll find a JetBrains IDE integration.
When you start it for the first time, OpenCode should automatically use the configured model.

Step 6 - Create the wrapper directory

If it doesn’t already exist:

mkdir -p ~/bin

Also create the OpenCode directories:

mkdir -p \
  ~/.config/opencode \
  ~/.local/share/opencode \
  ~/.local/state/opencode \
  ~/.cache/opencode

Step 7 - Create the Sandbox Wrapper

Create:

~/bin/opencode

Then set the OPENCODE_BIN variable to the path returned by which opencode.

#!/usr/bin/env bash

OPENCODE_BIN="/home/<user>/.opencode/bin/opencode"

if [[ ! -x "$OPENCODE_BIN" ]]; then
  echo "Error: OpenCode binary not found or not executable:"
  echo "  $OPENCODE_BIN"
  echo
  echo "Run 'which opencode' and update OPENCODE_BIN in this script."
  exit 1
fi

# Find the git repository root
git_root=$(git rev-parse --show-toplevel 2>/dev/null)

if [[ -z "$git_root" ]]; then
  echo "Warning: Not in a git repository; assuming current directory"
  git_root="$(pwd)"
fi

if [[ "$git_root" = "$HOME" ]]; then
  echo "Fatal: refusing to launch from HOME, since this would expose everything."
  exit 2
fi

systemd-run --user --pty --pipe --collect \
  -p PrivateTmp=yes \
  -p ProtectHome=tmpfs \
  -p TemporaryFileSystem=$HOME \
  -p InaccessiblePaths="/run/docker /run/dbus /run/NetworkManager" \
  -p NoNewPrivileges=yes \
  -p ProtectSystem=strict \
  -p ProtectKernelTunables=yes \
  -p ProtectControlGroups=yes \
  -p BindPaths="$git_root $HOME/.config/opencode $HOME/.local/share/opencode $HOME/.local/state/opencode $HOME/.cache/opencode" \
  -p BindReadOnlyPaths="$OPENCODE_BIN $HOME/.gitconfig $HOME/.gitignore" \
  -p WorkingDirectory="$(pwd)" \
  -E SHELL=/bin/bash \
  -E PATH="$PATH" \
  -E HETZNER_VLLM_API_KEY="$HETZNER_VLLM_API_KEY" \
  -- \
  "$OPENCODE_BIN" "$@"

This script builds on the article: https://stefansiegl.de/2026/02/sandboxing-with-systemd-run/. The article also includes a version for Nix.

Note: All files and directories specified in BindPaths and BindReadOnlyPaths must exist. For example, if ~/.gitignore does not yet exist, remove the corresponding entry or create the file first.

Step 8 - Make the wrapper executable

chmod +x ~/bin/opencode

Step 9 - Check the PATH

The wrapper only works if ~/bin appears in the PATH before the OpenCode installation directory. Otherwise, the system will still launch the original OpenCode binary.

Check:

which opencode

You should now see:

/home/<user>/bin/opencode

If the original binary is still displayed, add the following line to your ~/.bashrc:

export PATH="$HOME/bin:$PATH"

Then reload the shell configuration:

source ~/.bashrc

Check again afterward:

which opencode

Step 10 - Testing

In a Git repository:

opencode

Step 11 - Optional: Integration into JetBrains IDEs (ACP)

You can also use OpenCode directly from a JetBrains IDE.

• Open “AI Chat”
• Three dots in the top right → “Add Custom Agent”
• Enter the following configuration:

{
  "default_mcp_settings": {
    "use_idea_mcp": true
  },
  "agent_servers": {
    "opencode sandbox": {
      "command": "opencode",
      "args": ["acp"]
    }
  }
}

Conclusion

In this tutorial, you have successfully installed OpenCode and launched it in a sandbox. You can now use OpenCode directly in your project without it having access to your entire home directory.

License: MIT