Kortix Sandbox System Architecture

The Kortix sandbox is a Docker container running Alpine Linux with a full XFCE desktop, noVNC remote access, and the OpenCode AI agent platform. This document is the definitive reference for how the system works.

Container Image

• Base: lscr.io/linuxserver/webtop:latest (Alpine Linux + XFCE + noVNC)
• Process manager: s6-overlay v3 with s6-rc.d (NOT the older services.d)
• Entry point: /opt/startup.sh → exec unshare --pid --fork /init (PID namespace so s6 gets PID 1)
• User: abc (UID 1000, set via PUID=1000). All services run as abc via s6-setuidgid abc.

Key Paths

• /workspace/ — Docker volume. ONLY thing that persists across restarts. All user files live here.
• /opt/opencode/ — OpenCode config: agents, tools, skills, plugins, commands, opencode.jsonc.
• /opt/kortix-master/ — Kortix Master proxy + secret store + deployer server.
• /app/secrets/ — Docker volume. Encrypted secret storage.

Persistence Model