Configuration¶
This page lists the paths OpenCode Coding Assistant uses and the two ways the
listing lets you select a model. The image notes on the instance,
/opt/sushi/docs/README.md, are the package reference for anything not
repeated here.
Where things live¶
| Path | What it is |
|---|---|
opencode |
The terminal command. Check it with opencode --version. |
/var/lib/opencode/workspace/calculator.py |
Sample file created on first boot. Existing work is kept. |
~/opencode-demo |
Output of the local fixture, including the original mode 0600 task output. |
/opt/opencode/inputs.py |
Checker for the supplied fixture inputs. Run python3 /opt/opencode/inputs.py verify. |
/opt/opencode/inputs |
Original sources shipped with the package. |
/usr/share/doc/opencode |
Component notices. |
/opt/sushi/docs/README.md |
Image notes for this package. |
/opt/sushi/docs/demo.sh |
Local file-edit walkthrough. It does not call a paid model. |
sushi-opencode-firstboot.service prepares the sample workspace. It does not
replace work that is already there.
Model provider¶
Configure credentials after launch. Two options are documented:
- OpenCode credential store. Add your provider credentials as
ubuntuafter launch. Do not pass keys on the command line, and do not put them in user data. - Amazon Bedrock instance role. For Amazon Nova Lite in
us-east-1, setAWS_PROFILE=defaultso the SDK uses the temporary credentials from IMDSv2. The role has to allow invocation of the model you name. The image does not contain an AWS access key.
Name the model explicitly. The documented Bedrock invocation is:
AWS_REGION=us-east-1 AWS_PROFILE=default opencode run \
--model amazon-bedrock/amazon.nova-lite-v1:0 \
'Explain this calculator and suggest a small tested improvement'
Run that from a project you can restore. Inspect the resulting diff.
What stays on the instance¶
There is no application password to rotate. Access to the assistant is the
Session Manager session as ubuntu. There is no OpenCode port to publish.
Keep provider credentials in the credential store or in the instance role. Task output can contain source from the project. Leave that output on the instance unless you have removed secrets from it.
Last updated October 27, 2026 · Suggest an improvement