OpenCode, Claude Code and developer tools in Docker. Your projects and settings stay in persistent folders.
These views come from a local HolyCode validation build. The example uses local files.
Choose a screenshot
OpenCode 1.19.3 · local validation build
The real folder picker is open for the mounted sample project.
OpenCode 1.19.3 · local validation build
No prompt has been sent. The draft shows no model response.
Paperclip 2026.831.1 · local validation build
Paperclip is enabled for this capture. First-admin setup is shown; no account was created.
Local validation build
OpenCode shows a sample folder and an empty draft; no prompt was sent. Paperclip shows first-admin setup; no account was created.
The capture record identifies the local image, source versions and six unchanged original screenshots.
These are local-build UI captures. Released-image security evidence is separate.
OpenCode and Claude Code, plus git, lazygit, ripgrep, fd, fzf, bat, delta, tmux and browser tools.
Chromium, Playwright, Xvfb and Lighthouse are bundled. Read the browser guidance before automation.
Paperclip adds an agent board on port 3100. It is disabled by default.
Configure PaperclipA Docker host, model-provider access, credentials, backups and updates.
Anthropic, OpenAI, Gemini, Groq, AWS Bedrock, Azure OpenAI
Choose one in the installer. Set its credentials in your host environment.
HOLYCODE_PLUGIN_UPDATE=manual is the default: Claude Auth is installed only when missing, preserving your selected version. HOLYCODE_PLUGIN_UPDATE=auto syncs Claude Auth to the image’s pin at startup, not the latest release or every plugin. No verified token-refresh fix is claimed.
HolyCode-managed oh-my-openagent: managed installation suspended. Paperclip remains on compatibility hold. Bundled Hermes is unavailable; existing data stays at /home/opencode/.hermes. CLIProxyAPI is external-only; use it as an external endpoint.
Netlify CLI and serve are removed. Vercel CLI, sharp-cli, concurrently and LHCI are not bundled. Database tools are clients: Prisma, PostgreSQL client 17, Redis tools and SQLite connect to the services you run.
Claude credentials persist in /home/opencode/.claude/.credentials.json. Keep cache on local disk. For CIFS or SMB mounts, use nobrl,mfsymlinks.
The Linux image supports AMD64 and ARM64. Review the storage, snapshot and rollback guidance before updates. Rootless Podman instructions are available.
Other accepted upstream vulnerabilities remain; acceptance doesn't fix them or prove they're safe. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port. Avoid untrusted browser content and automation while known findings remain; these controls don't prove a finding is unreachable.
Scanner reports, package inventories and verified image digests. Security policy. Chromium issue #14.
