As opencode is inside your container, credentials and API keys are also inside the container. Prompt injection when your agent fetches some web site could have your agent leak this credentials to someone.
Also, do you restrict networking or does your container have full access to your internal network?
Also, do you restrict networking or does your container have full access to your internal network?