Add isolated sandbox profiles and local submodule build hardening

Author: pRizz

README.md

@@ -431,6 +431,43 @@ occ start --full-rebuild-sandbox-image
 - When the container fails to start due to image issues → try `--cached-rebuild-sandbox-image` first, then `--full-rebuild-sandbox-image`
 - When you want a completely fresh environment → use `--full-rebuild-sandbox-image`
 
+**Local submodule dev rebuild (no push required):**
+```bash
+# Fast rebuild using local packages/opencode checkout (including uncommitted edits)
+just run start --cached-rebuild-sandbox-image --local-opencode-submodule
+
+# Full no-cache rebuild from local packages/opencode checkout
+just run start --full-rebuild-sandbox-image --local-opencode-submodule
+```
+- This mode is for local development/debugging only and bypasses the default remote clone path.
+- `just run status` will show commit metadata derived from your local checkout (dirty trees are marked with `-dirty`).
+- Local context packaging intentionally skips heavyweight/dev metadata folders (for example `.planning`, `.git`, `node_modules`, `target`, and `dist`).
+- Keep CI/release workflows on the default pinned remote mode.
+
+### Dockerfile Optimization Checklist
+
+For new Docker build steps, follow this checklist:
+- Prefer BuildKit cache mounts (`RUN --mount=type=cache`) for package caches (`apt`, `bun`, `cargo`, `pip`, and `pnpm/npm`).
+- Create and remove temporary workdirs in the same `RUN` layer (for example `/tmp/opencode-repo`).
+- Do not defer cleanup to later layers; deleted files still exist in lower layers.
+- Keep builder-stage artifacts out of runtime layers by copying only final outputs.
+- When adding Docker build assets, update build-context inclusion logic in `packages/core/src/docker/image.rs`.
+- Keep local submodule exclude lists aligned with Dockerfile hygiene rules (`.planning`, `.git`, `node_modules`, `target`, `dist`, and similar dev metadata).
+
+This policy is intentional for both image-size hygiene and fast local rebuilds.
+
+**Worktree-isolated sandbox profiles (opt-in):**
+```bash
+# Derive a stable instance name from the current git worktree root
+just run --sandbox-instance auto start --cached-rebuild-sandbox-image
+
+# Use an explicit instance name
+just run --sandbox-instance mytree start --cached-rebuild-sandbox-image
+```
+- Default behavior (no `--sandbox-instance`) remains the shared legacy sandbox.
+- Isolated instances use separate container names, image tags, Docker volumes, and image-state files.
+- You can also set `OPENCODE_SANDBOX_INSTANCE=<name|auto>` instead of passing the CLI flag every time.
+
 ## Configuration
 
 Configuration is stored at:

packages/cli-rust/src/commands/logs.rs

@@ -11,7 +11,7 @@ use opencode_cloud_core::bollard::container::LogOutput;
 use opencode_cloud_core::bollard::exec::{CreateExecOptions, StartExecOptions, StartExecResults};
 use opencode_cloud_core::bollard::query_parameters::LogsOptions;
 use opencode_cloud_core::docker::{
-    CONTAINER_NAME, DockerClient, container_is_running, exec_command_exit_code,
+    DockerClient, active_resource_names, container_is_running, exec_command_exit_code,
 };
 
 /// Arguments for the logs command
@@ -38,6 +38,10 @@ pub struct LogsArgs {
     pub broker: bool,
 }
 
+fn active_container_name() -> String {
+    active_resource_names().container_name
+}
+
 /// Stream logs from the opencode container
 ///
 /// By default, shows the last 50 lines and follows new output.
@@ -46,6 +50,7 @@ pub struct LogsArgs {
 ///
 /// In quiet mode, outputs raw lines without status messages or colors.
 pub async fn cmd_logs(args: &LogsArgs, maybe_host: Option<&str>, quiet: bool) -> Result<()> {
+    let container_name = active_container_name();
     // Resolve Docker client (local or remote)
     let (client, host_name) = crate::resolve_docker_client(maybe_host).await?;
 
@@ -62,7 +67,10 @@ pub async fn cmd_logs(args: &LogsArgs, maybe_host: Option<&str>, quiet: bool) ->
         .map_err(|e| format_docker_error_anyhow(&e))?;
 
     // Check if container exists
-    let inspect_result = client.inner().inspect_container(CONTAINER_NAME, None).await;
+    let inspect_result = client
+        .inner()
+        .inspect_container(&container_name, None)
+        .await;
 
     match inspect_result {
         Err(opencode_cloud_core::bollard::errors::Error::DockerResponseServerError {
@@ -112,7 +120,7 @@ pub async fn cmd_logs(args: &LogsArgs, maybe_host: Option<&str>, quiet: bool) ->
     };
 
     // Get log stream
-    let mut stream = client.inner().logs(CONTAINER_NAME, Some(options));
+    let mut stream = client.inner().logs(&container_name, Some(options));
 
     // Process log stream
     while let Some(result) = stream.next().await {
@@ -125,7 +133,7 @@ pub async fn cmd_logs(args: &LogsArgs, maybe_host: Option<&str>, quiet: bool) ->
             Err(_) => {
                 // Stream error - check if container stopped
                 if follow
-                    && !container_is_running(&client, CONTAINER_NAME)
+                    && !container_is_running(&client, &container_name)
                         .await
                         .unwrap_or(false)
                     && !quiet
@@ -166,9 +174,10 @@ async fn stream_broker_logs(
 }
 
 async fn ensure_systemd_available(client: &DockerClient) -> Result<bool> {
+    let container_name = active_container_name();
     let systemd_available = exec_command_exit_code(
         client,
-        CONTAINER_NAME,
+        &container_name,
         vec!["test", "-d", "/run/systemd/system"],
     )
     .await
@@ -215,6 +224,7 @@ fn build_broker_journalctl_command(args: &LogsArgs) -> Result<Vec<String>> {
 }
 
 async fn create_broker_exec(client: &DockerClient, cmd: Vec<String>) -> Result<String> {
+    let container_name = active_container_name();
     let exec_config = CreateExecOptions {
         attach_stdout: Some(true),
         attach_stderr: Some(true),
@@ -225,7 +235,7 @@ async fn create_broker_exec(client: &DockerClient, cmd: Vec<String>) -> Result<S
 
     let exec = client
         .inner()
-        .create_exec(CONTAINER_NAME, exec_config)
+        .create_exec(&container_name, exec_config)
         .await
         .map_err(|e| anyhow!("Failed to create exec for broker logs: {e}"))?;
 
@@ -239,6 +249,7 @@ async fn stream_broker_exec_output(
     line_prefix: Option<&str>,
     quiet: bool,
 ) -> Result<()> {
+    let container_name = active_container_name();
     let start_config = StartExecOptions {
         detach: false,
         ..Default::default()
@@ -262,7 +273,7 @@ async fn stream_broker_exec_output(
                     }
                     Err(_) => {
                         if !args.no_follow
-                            && !container_is_running(client, CONTAINER_NAME)
+                            && !container_is_running(client, &container_name)
                                 .await
                                 .unwrap_or(false)
                             && !quiet
@@ -291,6 +302,7 @@ async fn stream_broker_logs_from_container(
     line_prefix: Option<&str>,
     quiet: bool,
 ) -> Result<()> {
+    let container_name = active_container_name();
     let follow = !args.no_follow;
     let options = LogsOptions {
         stdout: true,
@@ -301,7 +313,7 @@ async fn stream_broker_logs_from_container(
         ..Default::default()
     };
 
-    let mut stream = client.inner().logs(CONTAINER_NAME, Some(options));
+    let mut stream = client.inner().logs(&container_name, Some(options));
 
     while let Some(result) = stream.next().await {
         match result {
@@ -315,7 +327,7 @@ async fn stream_broker_logs_from_container(
             }
             Err(_) => {
                 if follow
-                    && !container_is_running(client, CONTAINER_NAME)
+                    && !container_is_running(client, &container_name)
                         .await
                         .unwrap_or(false)
                     && !quiet