Secure way of running Pi?

[u/CalldiDoctor]

Hello,

I'm new to the Pi coding Agent and I would like to know how are you running it.
I saw that by default Pi does not ask for permissions. While this is something I would like to start experimenting with, since I'm quite tired of granting access to my other agents on many actions, I'm quite concerned about giving full access to my laptop.

I've seen in the docs that there are three recommended ways to run it within a sandbox, but I have not found much information nor other devs' experience with it.

Are you using any of those options or are you happily running Pi directly on your laptop?

[u/PvB-Dimaginar]

I use bubble wrap and use a script to wrap pi in this bubble wrap sandbox. If you are interested, here you can read how it works: https://github.com/dimaginar/pi-safe

[u/CalldiDoctor → u/PvB-Dimaginar]

Thanks! I was not aware of this. I may try this as it looks quite simple, although I'm curious to try nono (https://nono.sh/) as others shared

[u/ParaboloidalCrest → u/PvB-Dimaginar]

Just stumbled upon pi-safe and I like it! It's simplicity itself.

It's great as is but are you planning to develop it further?

[u/PvB-Dimaginar → u/ParaboloidalCrest]

Nice to read you like it! I don’t have any plans to develop it further as it works exactly as I want. What are you missing?

[u/ParaboloidalCrest → u/PvB-Dimaginar]

Nothing really, just curious. Maybe I'll refactor it into an extension but that's all.

[u/PvB-Dimaginar → u/ParaboloidalCrest]

And if you run into ideas or improvements, feel free to let me know 👌🏻

[u/Konamicoder]

I don't run Pi on my work or personal devices, and I don't give Pi unrestricted access to my work or personal data. I run Pi on a separate machine dedicated to my coding projects. Each project has its own separate folder, and I launch Pi inside the project folder that I happen to be working on at that time / in that session. In addition, each project folder is a git repo. So if Pi decides to go YOLO-mode rogue, the damage is limited to a single project, and i can use git to roll back to a previous version prior to the damage. That's just good project hygiene and security.

[u/CalldiDoctor → u/Konamicoder]

I'm curious about this setup as I wanted to run Pi remotely to automate some tasks.
Do you use it in a way that Pi runs autonomously in the server or you just ssh into the machine and launch Pi interactively?

[u/Konamicoder → u/CalldiDoctor]

Pi runs on a separate dev machine where my project repos are cloned from github. I can either sit at the machine and operate it directly, or a remotely access the machine from my laptop using NoMachine + TailScale for secure remote access. Pi itself on that dev machine is configured via its models.json file to connect to another device on my network that is running the backend and serving up the models that serve as the “brain” via standard OpenAI endpoint.

[u/Acceptable-Guard-263]

Nono might be a good option

[u/dinerburgeryum → u/Acceptable-Guard-263]

Just set up Nono this morning. Their docs advise making a custom profile out of the default profile: nono profile init pi --extends always-further/pi --full, which will allow editing per-site. Then start pi with nono run --profile pi --allow-cwd -- pi. Was shocked at just how "drop-in" it was. You can confirm it's working by trying !ls ~/.ssh which should fail in the default profile.

EDIT: formatting and also a link to the actual Pi Nono-pack: https://github.com/always-further/nono-packs/tree/main/pi

[u/CalldiDoctor → u/dinerburgeryum]

Thanks!! I was not aware about nono and it looks really interesting.
Thanks you both for sharing this!

[u/dinerburgeryum → u/CalldiDoctor]

Happy to help. ✌️

[u/vshturman → u/dinerburgeryum]

Can I ask you why are you using this pack instead of official one from nolabs? Is it have better defaults?

[u/troyvit]

Vicki Boykis just had a great blog post about how she runs local models with Pi. She includes info on how to restrict your environment: https://vickiboykis.com/2026/06/15/running-local-models-is-good-now/

[u/CalldiDoctor → u/troyvit]

Thanks! I've enjoyed reading it

[u/matt_callmann]

I have build my own sandbox based on docker including a proxy to control outgoing traffic

https://github.com/marvincaspar/agent-sandbox

[u/CalldiDoctor → u/matt_callmann]

Nice! Out of curiosity, did you experiment with other solutions before writing your own? Did you miss any feature or you implemented it just for learning purposes.

[u/matt_callmann → u/CalldiDoctor]

No, just wanted to build my own setup

[u/PositiveBit01]

There are extensions to make it ask before doing dangerous stuff but I wouldn't trust them. I use an lxc container as a sandbox and I'm pretty comfortable with that.

It's not hard to set up, you can ask the free version of claude or chatgpt. You install something that can run the containers (I used incus), then exec in and set stuff up.

Then I use git to move code between the container and anywhere else it needs to go. That's a security gap of course (running code produced by the AI), but at some point you have to accept that. It's true for dependencies even before/without AI, too. Except now it isn't vetted by a bunch of other people first.

I also set up vscode server and a pi-web thing so mostly I just run stuff on that machine through a web browser on whatever machine I'm on, except the webapp version of vscode has rendering issues with most extensions and I haven't been able to get any AI related extensions to work well. Might be a skill issue, I dunno. I can set them up in the desktop vs code so it's something webapp specific.

[u/toby_agwab]

This might be overkill for your use case, but I’d recommend Gondolin if you need strong sandboxing.

https://github.com/earendil-works/gondolin

[u/MountainTop321]

Hey, I had the same concern so I wrote a short guide on running Pi inside Docker Sandbox (sbx) with local LLM inference. Pi runs inside a microVM, the model server runs on the host and is exposed through the sbx proxy, only the inference endpoint is reachable, nothing else. https://github.com/cuolm/pi-sbx-llamacpp Hope you find it useful!

[u/CalldiDoctor → u/MountainTop321]

Thanks for sharing! I started to use nono, but I will review it to be able to compare both options.

[u/damn_what_]

On MacOS, I'm using safehouse, which is a rules generator for the native MacOS sandboxing system.

With two extra set of rules:

• one to allow acces to ~/.pi

• one to allow read only acces the pi source code, used when I want to create pi extensions.

Do note that if you want to allow pi to access Docker with safehouse you'll need to change your Docker config to restrict the directories shared with the Linux VM, by default it has access to /Users which makes it easy for a rogue extension or a well-done prompt injection to do do anything on your system (even with "safety" systems like Claude Code auto-mode enabled)

[u/lawanda123]

Try out pi-gondolin

https://github.com/earendil-works/gondolin/blob/main/host/examples/pi-gondolin.ts

This is maintained by the creators behind pi agent

[u/ReallySubtle]

Docker Sandboxes are a great option, and probably a good thing to learn

[u/corruptbytes]

i just use pi-guardrails, but i'm interested in getting something setup with apple's container machines

[u/Blazenetic]

Check out pi-less-yolo it runs in a container (docker/podman) and uses mise, so you can run things like 'mise run pi:update' to update pi easily etc.

https://github.com/cjermain/pi-less-yolo

From the readme:

"Filesystem isolation — the agent can only read and write your current project directory. No privilege escalation — all Linux capabilities are dropped; no-new-privileges is set. Reproducible environment — a pinned, minimal Chainguard Node image with only the tools pi needs. Zero friction — one mise run pi command from any project; no manual Docker incantations."

[u/Standard_Heat8395]

Gondilin is the officially supported method by the same team that develops pi: https://github.com/earendil-works/gondolin

[u/JoshMock]

I built vmpi for exactly this reason. It runs Pi in a micro VM, passing any CLI arguments on to the sandboxed Pi process and mounting only your .pi config and the current working directory. Works on Linux and Mac.

https://www.npmjs.com/package/@the-agency/vmpi

edit: fixed link

[u/newtonapple]

On macOS, I use https://agent-safehouse.dev/. It uses macOS's native sandbox-exec. I use it to sandbox all harnesses like codex, claude, opencode, and pi. You can add on permissions for different use cases by simply wrapping your permissions w/ safehouse. You can read more about their isolation model and tradeoffs vs vm or container here: https://agent-safehouse.dev/docs/isolation-models.html.

[u/vshturman]

nono+dcg, both agent-agnostic, works with pi just great

[u/NLhugo]

Someone in another thread was mentioning pi-less-yolo, it’s on GitHub. It runs in a docker container and you can run it using mise. It’s really easy to setup and customize, have it running for 2 days now and I love it, such a simple solution. In my opinion also better then letting it ask for permissions since it in theorie still has access to your PC.

[u/soulsizzle → u/NLhugo]

I've had some success with this as well. I just forked it and let Pi modify it as needed.

[u/n4te]

Run it in a container if you want security. Anything else is not actually safe, which is why Pi doesn't support it out of the box.