I recently started experimenting with agents and found this sandboxing tool for OpenCode useful https://github.com/glennvdv/opencode-dockerized