Self-host OpenCode Manager

OpenCode Manager README

How to install OpenCode Manager

How to configure OpenCode Manager

• ADMIN_EMAILPre-configured admin email

  Pre-configured admin email

• ADMIN_PASSWORDPre-configured admin password

  Pre-configured admin password

• ADMIN_PASSWORD_RESET=falseSet to true to reset admin password

  Set to true to reset admin password

• AUTH_SECRET=Docker: generated on first start and kept in /app/data/.auth-secret; dev: random per startSession and credential encryption secret. Required for production outside Docker

  Session and credential encryption secret. Required for production outside Docker

• AUTH_SECURE_COOKIES=Runtime: true in prod, false in dev; Compose: false unless setUse secure cookies (HTTPS only)

  Use secure cookies (HTTPS only)

• AUTH_TRUSTED_ORIGINS=Runtime: http://localhost:5173,http://localhost:5003,http://127.0.0.1:5173,http://127.0.0.1:5003; Compose: http://localhost:5003 unless setComma-separated list of trusted origins (frontend + backend). The first entry is the auth base URL that OAuth providers redirect back to. The list also sets the allowed CORS origins and the origins allowed to open terminal and OpenCode proxy WebSockets. Browser requests that change state from another site (Sec-Fetch-Site: same-site or cross-site) are rejected unless their Origin is listed here. lo

  Comma-separated list of trusted origins (frontend + backend). The first entry is the auth base URL that OAuth providers redirect back to. The list also sets the allowed CORS origins and the origins allowed to open terminal and OpenCode proxy WebSockets. Browser requests that change state from another site (Sec-Fetch-Site: same-site or cross-site) are rejected unless their Origin is listed here. lo

• CORS_ORIGIN=http://localhost:5173Accepted but currently unused. CORS allows the origins in AUTH_TRUSTED_ORIGINS; /api/opencode-proxy/ and /api/internal/ allow any origin

  Accepted but currently unused. CORS allows the origins in AUTH_TRUSTED_ORIGINS; /api/opencode-proxy/ and /api/internal/ allow any origin

• DATABASE_PATH=./data/opencode.dbPath to SQLite database file

  Path to SQLite database file

• DEBUG=falseEnable debug logging

  Enable debug logging

• DISCORD_CLIENT_IDDiscord OAuth client ID

  Discord OAuth client ID

• DISCORD_CLIENT_SECRETDiscord OAuth client secret

  Discord OAuth client secret

• GITHUB_CLIENT_IDGitHub OAuth client ID

  GitHub OAuth client ID

• GITHUB_CLIENT_SECRETGitHub OAuth client secret

  GitHub OAuth client secret

• GOOGLE_CLIENT_IDGoogle OAuth client ID

  Google OAuth client ID

• GOOGLE_CLIENT_SECRETGoogle OAuth client secret

  Google OAuth client secret

• HEALTH_CHECK_TIMEOUT_MS=30000OpenCode liveness probe timeout

  OpenCode liveness probe timeout

• HOST=0.0.0.0Server bind address

  Server bind address

• LOG_LEVEL=infoAccepted but currently unused; debug output is controlled by DEBUG

  Accepted but currently unused; debug output is controlled by DEBUG

• MAX_FILE_SIZE_MB=50Maximum file size for reading/preview

  Maximum file size for reading/preview

• MAX_UPLOAD_SIZE_MB=50Maximum upload file size

  Maximum upload file size

• MSB_API_KEYMicrosandbox API key passed through to the client

  Microsandbox API key passed through to the client

• MSB_API_URLMicrosandbox API URL passed through to the client

  Microsandbox API URL passed through to the client

• MSB_BACKEND=localBackend the microsandbox client uses

  Backend the microsandbox client uses

• MSB_HOME=~/.microsandboxMicrosandbox home directory for state

  Microsandbox home directory for state

• MSB_LIBKRUNFW_PATH=/opt/microsandbox/lib/libkrunfw.soPath to the libkrunfw firmware library used by msb (set in the container image)

  Path to the libkrunfw firmware library used by msb (set in the container image)

• MSB_PATH=msbPath to the msb executable

  Path to the msb executable

• MSB_PROFILEMicrosandbox profile passed through to the client

  Microsandbox profile passed through to the client

• NODE_ENV=developmentEnvironment (development or production)

  Environment (development or production)

• OPENCODE_BINPath to an externally managed OpenCode binary. Overrides binary discovery; while set, in-app upgrade and version install are disabled (HTTP 409)

  Path to an externally managed OpenCode binary. Overrides binary discovery; while set, in-app upgrade and version install are disabled (HTTP 409)

• OPENCODE_HEALTH_FAILURE_THRESHOLD=2Failed health checks before recovery starts

  Failed health checks before recovery starts

• OPENCODE_HEALTH_POLL_MS=30000OpenCode health watcher poll interval

  OpenCode health watcher poll interval

• OPENCODE_HEALTH_WATCH_ENABLED=true (false in tests)Enable OpenCode health watcher and recovery

  Enable OpenCode health watcher and recovery

• OPENCODE_HOST=127.0.0.1OpenCode server bind address

  OpenCode server bind address

• OPENCODE_IMPORT_CONFIG_PATH=~/.config/opencode filesExisting standalone OpenCode config file to import on first startup. When set to an existing file, only that file is imported. When unset, or set to a path that does not exist, the host's opencode.json, opencode.jsonc, and legacy config.json in ~/.config/opencode are mirrored into the workspace, workspace copies absent on the host are removed, and the mirrored legacy file is folded into the worksp

  Existing standalone OpenCode config file to import on first startup. When set to an existing file, only that file is imported. When unset, or set to a path that does not exist, the host's opencode.json, opencode.jsonc, and legacy config.json in ~/.config/opencode are mirrored into the workspace, workspace copies absent on the host are removed, and the mirrored legacy file is folded into the worksp

• OPENCODE_IMPORT_STATE_PATH=~/.local/share/opencodeExisting standalone OpenCode state directory to import on first startup. The first of this path and the default that contains opencode.db is used

  Existing standalone OpenCode state directory to import on first startup. The first of this path and the default that contains opencode.db is used

• OPENCODE_SERVER_PASSWORD=auto-generatedBasic Auth password for the managed OpenCode server. OpenCode 2 always requires one: when unset, OpenCode Manager generates and persists a password (override it any time via Settings → OpenCode → Server Auth). DB-stored passwords override this env var. The default docker-compose.yml does not forward this variable from .env; add it to the compose environment: block or set it via Settings → OpenCode

  Basic Auth password for the managed OpenCode server. OpenCode 2 always requires one: when unset, OpenCode Manager generates and persists a password (override it any time via Settings → OpenCode → Server Auth). DB-stored passwords override this env var. The default docker-compose.yml does not forward this variable from .env; add it to the compose environment: block or set it via Settings → OpenCode

• OPENCODE_SERVER_PORT=5551Port for the OpenCode CLI server

  Port for the OpenCode CLI server

• PASSKEY_ORIGIN=http://localhost:5003Origin URL for WebAuthn (backend port)

  Origin URL for WebAuthn (backend port)

• PASSKEY_RP_ID=localhostRelying party ID (your domain)

  Relying party ID (your domain)

• PASSKEY_RP_NAME=OpenCode ManagerDisplay name for passkey prompts

  Display name for passkey prompts

• PORT=5003Server port

  Server port

• PREVIEW_PORT=5004Port for the preview gateway. Set to 0 to disable preview entirely. If the port is already in use, the Manager starts anyway, logs a warning and reports preview as unavailable.

  Port for the preview gateway. Set to 0 to disable preview entirely. If the port is already in use, the Manager starts anyway, logs a warning and reports preview as unavailable.

• PREVIEW_PUBLIC_URL=emptySame-site HTTPS origin that proxies the preview gateway; do not add it to AUTH_TRUSTED_ORIGINS. Set this when the Manager is served over HTTPS or behind a reverse proxy, where mixed content and third-party cookies otherwise block the preview iframe.

  Same-site HTTPS origin that proxies the preview gateway; do not add it to AUTH_TRUSTED_ORIGINS. Set this when the Manager is served over HTTPS or behind a reverse proxy, where mixed content and third-party cookies otherwise block the preview iframe.

• PROCESS_START_WAIT_MS=2000Wait time for OpenCode process to start

  Wait time for OpenCode process to start

• PROCESS_VERIFY_WAIT_MS=1000Wait time for process health verification

  Wait time for process health verification

• REPO_BROWSE_ROOT=empty (disabled)Root directory the folder browser may browse (supports ~). When unset, folder browsing is disabled

  Root directory the folder browser may browse (supports ~). When unset, folder browsing is disabled

• SANDBOX_CPUS=2Default microVM CPU count, used when neither a Settings default nor a per-session override is set

  Default microVM CPU count, used when neither a Settings default nor a per-session override is set

• SANDBOX_EXEC_TIMEOUT_MS=600000Timeout for a single sandboxed command, in milliseconds

  Timeout for a single sandboxed command, in milliseconds

• SANDBOX_EXEC_USER=${PUID:-1000} via the overlay, otherwise nodeGuest identity sandboxed commands run as: a numeric uid, a numeric uid:gid, or a guest username. A numeric uid must match the Manager's effective uid (PUID); the compose overlay defaults it to ${PUID:-1000}. A guest username is resolved to the Manager's effective uid:gid so writes to the mounted project roots always succeed. When a configured numeric identity cannot write the workspace, enforcemen

  Guest identity sandboxed commands run as: a numeric uid, a numeric uid:gid, or a guest username. A numeric uid must match the Manager's effective uid (PUID); the compose overlay defaults it to ${PUID:-1000}. A guest username is resolved to the Manager's effective uid:gid so writes to the mounted project roots always succeed. When a configured numeric identity cannot write the workspace, enforcemen

• SANDBOX_IMAGE=docker.io/cstechdev/ocm-sandbox@sha256:9df035cf…OCI image the microVM boots from. Digest-pinned by default so a rebuilt guest image is actually adopted; see Sandbox Guest Image for what the default ships and how to build your own

  OCI image the microVM boots from. Digest-pinned by default so a rebuilt guest image is actually adopted; see Sandbox Guest Image for what the default ships and how to build your own

• SANDBOX_MEMORY=4GDefault microVM memory (e.g. 4G), used when neither a Settings default nor a per-session override is set

  Default microVM memory (e.g. 4G), used when neither a Settings default nor a per-session override is set

• SANDBOX_NET=publicNetwork mode for the microVM: public, private, or host, or a comma-separated composition (for example public,host). Passed to msb run --net and attested against the profile's canonical network policy

  Network mode for the microVM: public, private, or host, or a comma-separated composition (for example public,host). Passed to msb run --net and attested against the profile's canonical network policy

• SANDBOX_START_TIMEOUT_MS=300000Timeout for microVM startup, in milliseconds

  Timeout for microVM startup, in milliseconds

• VAPID_PRIVATE_KEYVAPID private key for push notifications

  VAPID private key for push notifications

• VAPID_PUBLIC_KEYVAPID public key for push notifications

  VAPID public key for push notifications

• VAPID_SUBJECTContact email for VAPID (MUST use mailto: format)

  Contact email for VAPID (MUST use mailto: format)

• VITE_API_URL=empty (same origin)Backend API URL for frontend. Empty (the default) means same-origin requests; the Vite dev server proxies /api to the backend

  Backend API URL for frontend. Empty (the default) means same-origin requests; the Vite dev server proxies /api to the backend

• VITE_MAX_FILE_SIZE_MB=50File size limit for frontend

  File size limit for frontend

• VITE_MAX_UPLOAD_SIZE_MB=50Upload size limit for frontend

  Upload size limit for frontend

• VITE_OPENCODE_PORT=5551OpenCode server port hint

  OpenCode server port hint

• VITE_SERVER_PORT=5003Backend port hint for frontend

  Backend port hint for frontend

• WORKSPACE_PATH=./workspace (Docker: /workspace)Path to workspace directory (supports ~)

  Path to workspace directory (supports ~)