I started building my own isolated and security-hardened docker image for OpenCode about half a year ago. Been using it daily.

https://github.com/pkhamre/opencode-docker