This application places an AI agent next to a privileged TrueNAS API credential. Treat access to its browser terminal as administrative access to the appliance.

Report vulnerabilities privately through GitHub Security Advisories for avaneerd/opencode-for-truenas. Do not include API keys, configuration exports, logs containing secrets, or other live credentials in a public issue.

• The container runs as a non-root user and receives no Linux capabilities.
• It does not mount the Docker socket, TrueNAS middleware socket, or /mnt as a whole.
• TrueNAS 25.10 API keys use plaintext authentication protected by TLS. Keep certificate verification enabled.
• Read-only MCP calls are automatically allowed. Administrative calls require interactive OpenCode approval.
• OpenCode shell and file edits require approval.
• The TrueNAS API key is mounted as a container config rather than passed to OpenCode in its environment.

These controls reduce accidental access; they do not make an untrusted model or terminal user safe. A Full Admin API key remains password-equivalent and can cause irreversible data loss.