OpenCode, self-hosted.Ready to run.

Pull the image and policy

Use the published tag for both the image and Chromium policy.

mkdir -p config
curl -fsSL https://raw.githubusercontent.com/CoderLuii/HolyCode/v1.2.5/config/chromium-seccomp.json -o config/chromium-seccomp.json
docker pull coderluii/holycode:1.2.5

Create compose.yaml

Keep the local service bound to 127.0.0.1 and the three shipped volumes explicit. The configurator above produces the complete file.

services:
  holycode:
    image: coderluii/holycode:1.2.5
    container_name: holycode
    restart: unless-stopped
    shm_size: 2g
    ports:
      - "127.0.0.1:4096:4096"
    security_opt:
      - seccomp=./config/chromium-seccomp.json
    volumes:
      - ./data/opencode:/home/opencode
      - ./local-cache/opencode:/home/opencode/.cache/opencode
      - ./workspace:/workspace
    environment:
      - "PUID=1000"
      - "PGID=1000"
      - "HOLYCODE_PLUGIN_UPDATE=manual"
      - "ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}"

Start and open

docker compose up -d

Open http://localhost:4096 after the container starts. Keep ./local-cache/opencode on local disk. For CIFS or SMB mounts, use nobrl,mfsymlinks. The Podman guide covers rootless setup.

Update with a snapshot

docker compose stop
# Snapshot ./data/opencode, ./local-cache/opencode, and ./workspace
# Update the image and Chromium policy to the new release
docker compose pull
docker compose up -d

A snapshot rollback restores untouched pre-upgrade volumes and starts the previous image. It does not claim an in-place database downgrade.