Choose the image for the work
Trusted Opencode images package a practical development environment around an explicit container boundary. Pull the image that matches the job, then use the Airlock repository for entry scripts and compositions.
Build Java.
Start a workspace, mount a project, and let an agent build and test it without touching the host directly.
Compile native code.
Use a real compiler toolchain to build and test a small C or C++ project inside the boundary.
Develop with Chromium.
Load a real site, capture the rendered page, and turn visual inspection into the next development decision.
Plan infrastructure.
Run OpenTofu and inspect a Kubernetes workflow from a workspace with its own cloud operations tools.
Keep the boundary explicit
An Airlock workspace does not need the host Docker socket. When container workflows are required, the development images can run a rootless Docker daemon inside the workspace. The outer runtime still decides which mounts, ports, devices, and environment variables are allowed through.
Not a magic security claim: Airlock makes the boundary inspectable and configurable. Review the mounts and permissions for the work you are about to run.
Get the workspace
Docker Hub contains the published multi-architecture images. Choose one of the four examples above, then use the source repository for build scripts, entry scripts, rootless Docker support, and composition examples.