HolyCode
One container. 50+ tools. Your provider.
Works with Anthropic, OpenAI, Gemini, Groq, Bedrock, Azure, Vertex AI, Ollama, and more. Free and open source.
Don't want to self-host? Try HolyCode Cloud
Quick Start
From zero to AI coding in under a minute.
Get the image and Chromium policy
$ mkdir -p config
$ curl -fsSL https://raw.githubusercontent.com/CoderLuii/HolyCode/v1.1.3/config/chromium-seccomp.json -o config/chromium-seccomp.json
$ docker pull coderluii/holycode:1.1.3Create a compose.yaml
services:
holycode:
image: coderluii/holycode:1.1.3
container_name: holycode
restart: unless-stopped
shm_size: 2g # Chromium needs this
ports:
- "4096:4096" # OpenCode web UI
# - "3100:3100" # Paperclip when enabled
security_opt:
- seccomp=./config/chromium-seccomp.json
volumes:
- ./data/opencode:/home/opencode
- ./local-cache/opencode:/home/opencode/.cache/opencode
- ./workspace:/workspace
environment:
- PUID=1000
- PGID=1000
# - ENABLE_PAPERCLIP=true
- ANTHROPIC_API_KEY=your-key-here # Or swap for any supported provider keyStart and open
$ docker compose up -dOpen http://localhost:4096. Keep ./local-cache/opencode on local disk. For NAS mounts, use nobrl,mfsymlinks. The Podman guide covers rootless setups.
Update with a snapshot
$ docker compose stop
$ # Snapshot data/opencode and workspace before continuing.
$ # Set image: coderluii/holycode:1.1.3 in your Compose file.
$ curl -fsSL https://raw.githubusercontent.com/CoderLuii/HolyCode/v1.1.3/config/chromium-seccomp.json -o config/chromium-seccomp.json
$ docker compose pull
$ docker compose up -dChange the pinned Compose image to coderluii/holycode:1.1.3 before pulling. A snapshot rollback means stopping the stack, restoring untouched pre-upgrade volumes, and starting the previous image. In-place database downgrades are not supported.
What You Get
A maintained workstation with an explicit, versioned toolset.
OpenCode AI Agent
OpenCode 1.18.4 serves the web UI on port 4096. Protect it with OPENCODE_SERVER_PASSWORD.
Claude Subscription
Claude Code 2.1.216 stores credentials at /home/opencode/.claude/.credentials.json.
Multi-Agent Orchestration
Pins: oh-my-openagent 4.19.0 and opencode-claude-auth 2.0.0. HOLYCODE_PLUGIN_UPDATE=manual preserves your versions; HOLYCODE_PLUGIN_UPDATE=auto syncs to image pins.
CLI Workstation
Use opencode run, opencode attach, and opencode providers login inside the container.
Persistent State
Settings, sessions, MCP configs, plugins, and Claude credentials survive container replacement through the home mount.
50+ Dev Tools
git, ripgrep, pnpm, TypeScript, Prisma, Lighthouse, ffmpeg, and more. Netlify supports remote build and deploy commands; Vercel CLI, sharp-cli, concurrently, and LHCI are not bundled.
Paperclip Board
Paperclip 2026.707.0 is optional on port 3100. Keep authentication enabled and restrict allowed hostnames to your trusted LAN or VPN.
Hermes migration
The bundled Hermes is unavailable in v1.1.3. Existing /home/opencode/.hermes data stays preserved; old ENABLE_HERMES=true settings now stop with migration guidance.
External CLIProxyAPI
CLIProxyAPI is external-only. Point the supported CLIPROXYAPI_* settings at an instance you operate separately.
Headless Browser
Chromium, Xvfb, and Playwright run as the non-root user with the supplied seccomp policy and browser sandbox enabled.
Current runtime
Node.js 24.18.0, npm 12.0.1, and Python 3.13.5 on Debian Trixie.
s6-overlay
Process supervision. Auto-restart. Clean shutdown. No zombies.
Any Provider. Your Choice.
OpenCode is provider-agnostic. Bring your own key, use any model.
Anthropic
OpenAI
Gemini
Groq
AWS Bedrock
Azure OpenAI
Plus Vertex AI, GitHub Models, Ollama, and any OpenAI-compatible endpoint via OpenCode's provider system.
Set one key. Or set all of them. Switch providers anytime without rebuilding. Prefer Podman? HolyCode uses the same container image there too.
Why HolyCode
I built this because I was tired of re-doing the same setup every time. Installing OpenCode, configuring a headless browser in Docker, fixing UID permission issues, debugging process supervision. Every. Single. Time.
So I packaged the working setup into one container. Tools, browser, process supervision, and persistent state are wired up before first boot. You pull it and go.
Your environment should follow you. Not the other way around.
HolyCode Cloud
A browser workstation with an editor, terminal, persistent workspace, and bring-your-own-key provider access. Early access is open.
Get Early AccessReady to stop rebuilding?
Pull one image. Keep your workspace between rebuilds. Your AI coding workstation, portable and ready.