pkhamre/opencode-container ? reverse-engineered prompt

Build me a secure container setup for running the OpenCode CLI in isolation with Docker or Podman.

I want one easy launcher script I can run from any folder, and it should keep my sessions, cache, and settings in my home directory while using the current folder as the only writable workspace. Please make it load API keys from secret files instead of the command line, and support common providers like Anthropic, OpenAI, Google, AWS Bedrock, and Context7. The container should be locked down by default, with a read only root filesystem, no extra Linux capabilities, no privilege escalation, and a non root user.

It would be great if there is a simple way to update the config from the repo, enable web search or experimental features, and optionally allow access to host services when needed. If anything depends on current OpenCode or container docs, look them up online and make the wrapper behave the right way.