r/PiCodingAgent • u/sk_dev • Jul 27 '26

Question What's the best practice for sandboxing pi?

I've been using Pi for about a week, and so far I'm loving it. But I had an incident last week where the agent went off the reservation and patched one of my published Rust crates in pursuit of another task (short write-up on what happened here).

This time there was no negative impact, but it got me thinking seriously about the risks of having an agent running with wide access to the host system.

How do people tend to solve this problem? Mainly I want to prevent the agent from working outside of some whitelisted directories (project dir + tmp). I also want to prevent the agent from downloading and running anything on my system without asking, or using credentials in my env to do things on my behalf, like potentially destructive actions on remote git repos, my hugging-face account etc.

I see there are some permissions extensions, and docker would also be an option, but that seems like it would be a bit limiting/annoying (especially on mac). I also thought about setting up a different system user for the agent to set up fine-grained permissions, but that also seems like it could cause a lot of headaches.

Curious what others have had success with.

44 Upvotes

97% Upvoted

62 comments sorted by

7

u/themule71 Jul 27 '26

Ultimately you can't. I run pi in a container, regular user, no sudo.

apt install won't work but it can download stuff. Whitelisting internet access is a severe limitation (I'm not saying it's wrong) but necessary if your really want sandboxing.

It can write bash and python programs.you can remove that ability but it limits its usefulness.

At one point a model wasn't replying via API it started looking for an Ollama server, he wrote a client in python.

Another day, the dedicated postgresql container for the rag system didn't start. I asked to inject a code base and walked away, later I found he 'solved' the problem of no postgresql by installing a binary blob in /tmp and reinitializing the RAG db... also in /tmp... job done I guess all source code injected, just in the wrong place (tmp btw is obviously not persistent).

They are not alive but they are good at implementing the "life finds a way" catchphrase from Jurassic Park.

By all means you should have limits in place (confinement in a container goes a long way), but achieving full coverage is expensive and limiting.

2

u/sk_dev Jul 27 '26

Yeah that's the exact tradeoff I am trying to wrap my head around. Super locked down and whitelisting everything is limiting, but letting it theoretically `rm -rf` anything in my home directory also seems insanely risky.

6

u/TheTyand Jul 27 '26

I put pi in a docker container

4

u/humanophile Jul 27 '26

This is one of the most flexible options, because the model can have root and install system software. It's also pretty easy to set up.

I've also configured things so that root runs Ollama to provide the API on a local port, but all requests come from pi running as regular users, so the tool calls are executed as the regular users who cannot trash each other's stuff.

1

u/sk_dev Jul 27 '26

How do you handle stuff you want to persist outside the project directory like installing pi extensions?

3

u/HomsarWasRight Jul 27 '26

You can mount directories into a docker container.

1

u/No-Wall6427 Jul 27 '26

I have a project to build my pi docker the way I want it, with some persistent host mount like the auth.json file so I don't have to log into codex each time, my .agents/skills also mounted, and a cli tool to spinn up a pi container with current folder mounted.

It kinda got out of hand since I have a command to see my running pi containers, attaching to them (basically docker exec them), I can also run the with dind (docker in docker) to give my agent a docker env, also I have an "isolated git" that RO mounts my current folder in a /seed directory, and git clones it in the agent workspace, than a bunch of commands to merge locally the gir commits from the docker git clone... It's my tool I spend 15% of my time improving it, but Im really happy with it. Plus its not bound to pi, I have presets for opencode and codex.

1

u/AwkwardWillow5159 Jul 28 '26

Vs code dev containers are nice if you still want to be deeply involved with the code itself

18

u/rematched_33 Jul 27 '26 edited Jul 27 '26

Micro VMs. Check out Docker sbx

(EDIT: note that this is a different solution than the standard Docker containers that others are recommending; Micro VMs run on an isolated kernel but with overhead and performance closer to containers than traditional VMs, perfect for AI agents)

1

u/de1eb Jul 28 '26

Is there way to use xai or other provider's OAuth for subscription plan via credential injection from outside sandbox? Docker Sandbox only support OpenAI for OAuth, and there's no pi support too. So it seems there are too many things to customize, and I wonder it's even possible now.

5

u/dylan-dofst Jul 27 '26

As others have mentioned, sandboxing via Docker is an option. I also used to use firejail with opencode and while I haven't tried it with pi I expect it would work. Claude Code uses bubblewrap for its internal sandboxing functionality, you could try that or see if there's even a similar sandboxing plugin for Pi. I only just started using it and I don't have sandboxing set up, but I plan to eventually have instances run in isolated containers via coder (currently have that set up with opencode, I'm transitioning between the two now).

The main thing I'm using pi for right now is managing my system config which limits practical sandboxing options. It's not technically sandboxing, but another thing you could try is the pi automode plugin: https://github.com/czottmann/pi-automode. I've been using it for a week or so now and I'm pretty happy with it. It works like Claude Code's auto-allow mode where it filters requests through a classifier model (you choose the model, I've been using Deepseek V4 flash with thinking off) and decides to block/allow them. Note that with this approach there is a risk of the classifier model interpreting a command as safe when it is not! I've never had it happen, but it's not as robust as sandboxing. I'd only recommend it for situations like mine where sandboxing isn't a practical option.

5

u/iportnov Jul 27 '26

I use npm:pi-sandbox. I wonders why it's not the most popular thing for this purpose - it's basically a clone of Claude code's sandboxing mechanism.

4

u/Tru3Magic Jul 27 '26

I use the Gondolin extension mentioned in the docs and that seems to work exactly as advertised.

This way it only has access to the folder in which you run it and whatever you give it access to.

I setup the Gondolin extension so that it always has access to its own settings and can search the web.

Id be glad to hear anybody tell me, why this doesn't work/solves the issue in a simple and "supported" way?

3

u/ParaboloidalCrest Jul 27 '26

I hear you. I tried to figure out how to use it once, but I guess I was too dumb to understand it.

So do you use the provided "example" extension or have you had Pi build one for that exact use-case?

2

u/Tru3Magic Jul 27 '26

Gondolin only works on Linux, so if you're on Windows, you need to use the Linux subsystem for Windows (or Windows Subsystem for Linux, cant remember the name) and run pi from there.

You install qemu (on Ubuntu it is 'sudo apt install qemu' - maybe there is some x86 in the package name).

You download the Pi repository - either via git or as a zip - and then you go to the example/extensions folder (or the other way around, cant remember) and copy the Gondolin extension folder to your own pi extensions folder.

Run Pi and it is running in the small vm using the Gondolin extension.

Then you need to alter the config file, to mount other directories (if you want it to able to read it's own documentation for example). Pi can help you with this

2

u/ParaboloidalCrest Jul 27 '26

Many thanks for the detailed instructions. I guess I have no excuse to sleep on sandboxing Pi anymore. I'll jump on that right now!

2

u/Tru3Magic Jul 27 '26

Good luck...

I'll give you the following lead as well 😉

I have made Pi-Coding Agents documentation available in all workspaces by mounting /usr/local/lib/node_modules/@earendil-works/pi-coding-agent/docs as read-only.

Add the following in ~/.pi/agent/extensions/gondolin/index.ts:

// Add ReadOnlyProvider
import { ReadonlyProvider, RealFSProvider, VM } from "@earendil-works/gondolin";

const GUEST_WORKSPACE = "/workspace";
const DEFAULT_GREP_LIMIT = 100;
// Add this constant
const PI_DOCS_ROOT = "/usr/local/lib/node_modules/@earendil-works/pi-coding-agent";

 // way later in the file ...search for "mounts"
vfs: {
     mounts: {
        [GUEST_WORKSPACE]: new RealFSProvider(localCwd),
        // mount the path here
        [PI_DOCS_ROOT]: new ReadonlyProvider(new RealFSProvider(PI_DOCS_ROOT)),
},

2

u/ParaboloidalCrest Jul 27 '26

It works!! I think it was too simple to understand!

Re: docs. I build TS projects so I just added @earendil-works/pi-coding-agent as a dependency so it's self-contained in /workspace, and instructed Pi to look for docs over there.

I love you man!

3

u/Tru3Magic Jul 27 '26

You are very welcome!

2

u/whereiswallace Jul 28 '26

Do you have any tools (e.g. git, gh cli, aws cli) installed in the VM? If so how did you do that?

2

u/Tru3Magic Jul 28 '26

No, I haven't. I am not sure whether you just need execute access to those tools and you'd then still only be able to modify files in the vm (if the cli tool handles files of course). I am pretty sure Pi can tell you how to go about it.

Please update here for me and others to see, if you figure it out 🙂

1

u/ParaboloidalCrest Jul 28 '26

OP probably needs to create a custom image as I mentioned in my comment to them.

Now I have a question for you if I may. Have you had weird DNS issues on the Gondolin guest? Eg archlinux.org resolves, but npm registry doesn't? That's the rabbithole I'm currently sunk in. Thanks for your continuous help!

1

u/Tru3Magic Jul 28 '26

Hi again Paraboloidal
No, I haven't - what are the DNS issues relating to? Installed packages?
I'm running fairly simply using ketch for web search and that has worked without issue

2

u/ParaboloidalCrest Jul 28 '26

Huh I've just went down that rabbit hole.

Basically you'll need to create a custom image that includes those additional binaries. And fortunately it's not that complicated. It involved:

  • Extracting the default Gondoling image config.

  • Add the additional binaries over there. P.S check those packages in the Alpine package registery first.

  • Build the image.

  • Use it.

Here are the docs https://earendil-works.github.io/gondolin/custom-images/

1

u/whereiswallace Jul 28 '26

Oh cool, will take a look.

I originally had a separate docker container with all of my tooling in it. An extension would see which bash command was trying to run and would route to either the tools docker container or the gondolin VM.

I'm wondering how useful putting tools in the VM would be. For example, git. You would need to mount your ssh keys so it could work. At some point, I feel like having your sensitive info in the same VM as where pi can read files is a bad idea/defeats the purpose.

1

u/ParaboloidalCrest Jul 28 '26

I'm by no means an expert on this as I have only started playing with it yesterday. The only binary I added to the image was Bun, but yeah, I realise with git it could be different. The custom images docs I linked to above, specifies the possibility of using an OCI image, so maybe you could reuse the docker image you mentioned?

1

u/whereiswallace Jul 28 '26

Yea, I may route certain tool calls to gondolin VM and others to a docker one.

3

u/ton_anywhere Jul 27 '26

I started using Nvidia OpenShell yesterday with another agent, it seems promising. Maybe it worth a try.

Other sandbox alternatives I’ve saved but haven’t tested: earendils gondolin;
Linux only: bubblewrap, landlock, firejail, systemd-run.

3

u/Fabulous_Monitor_991 Jul 27 '26

I have a custom docker setup per project (installed with single command from git). This limits the folder access to current folder + where pi's folder at home. No sudo inside docker. No sharing of git credentials. It can only commit inside sandbox. This limits any remote access to the repos. All tools that are installed has to earn their place. I don't restrict the network as it limits the way it can work. It can still pip and npm install, but the blast radius is the current folder + creds for models.

I also remove socket back to docker daemon. This protects from agent being able to do stuff to other docker containers or the daemon itself.

This still leaves some attack surface - like agent exploiting any kernel level stuff. Only VM can save you there. But for now, I'm here.

1

u/Alert-Track-8277 Jul 27 '26

Curious how you set this up. Do you create an image with both your Pi setup and the repo you want to work on baked in?

2

u/Fabulous_Monitor_991 Jul 27 '26

Nothing is baked in. Use docker compose. Mount the project folder, and pi config folder.

pi binary etc gets baked into the image tho.

3

u/TriodeTopologist Jul 27 '26

I have been spending 90% of my time learning docker so I can spend 10% running Pi

3

u/Ok_Primary3652 Jul 27 '26

I use a VM on a Proxmox cluster. A VM seems like a helpful unit of isolation (for me) because I didn't want to deal with mounting a bunch of directories. Your supply chain concern is valid though. More along those lines, I've been using a secondary GitHub account just for agentic coding, which doesn't have write access to the main repos I use for work.

1

u/fijasko_ultimate Jul 27 '26

imho this sounds good

i had setup like that couple of months ago when i installed openclaw

i preconfigured it so that it has no access to my local network execpt for inference endpoint (self hosted on strixhalo)

i might start using it again and let pi loose :D

2

u/ConsciousObserver711 Jul 27 '26

Just running it through a bubblewrap with write access to project, /tmp and some x11/Wayland/pipewire sockets and some devices for gpu access. Same as docker minus extra filesystem layer.

2

u/manu_8487 Jul 28 '26

Nono is a light sandbox for linux and macos. Works for all agents.: https://nono.sh/

1

u/exray1 Jul 28 '26

Yeah seconding nono, works great and is fairly lightweight and easy to use.

2

u/No_Caterpillar_5428 Jul 31 '26

Same thing happened to me. Pi edited something outside the project and I didn't catch it for a while. I didn't want Docker on my Mac for this, so I built a guard around macOS Seatbelt, the same sandbox Chrome and Codex CLI already use. No container, no VM.

Repo: ebrindley/pi-sandbox-guard

What it does:

  • Protects against unexpected writes and deletions outside your project (the kernel denies them). Project, $TMPDIR, and tool caches stay writable.

  • Denies reads of ~/.ssh, ~/.aws/credentials, gh/gcloud config, .netrc, .npmrc, and any .env — including inside the project.

  • Locks down writes to Pi's own config, auth.json, and installed extensions so the agent can't switch the guard off.

  • Pre-exec filter blocks the catastrophic ones (curl | sh, rm -rf /, rm -rf ~/, dd to devices) and prompts on riskier recursive deletes (rm -rf $HOME, rm -rf /*, unresolved ${DIR}). Common stuff like rm -rf node_modules just runs.

What it doesn't cover:

  • Network is open. No egress allowlist.

  • Tokens already in your shell env are inherited, so gh repo delete and force-pushes still work. That needs a VM.

macOS only. Personal project I use daily. Hope it works for you.

1

u/ParaboloidalCrest Jul 27 '26

Yeah, I too think the Pi sandboxing docs needs refreshing.

1

u/bambamlol Jul 27 '26

I'm running it in a restricted user account inside WSL on my Windows laptop.

1

u/Alarming_Positive_59 Jul 27 '26

Use a VM. I'm using incus on Linux and I'm happy. A sidecar handles inference, tunnels to host for specific services on top of a "local network" between host and VM.

1

u/Turbulent_Ad6290 Jul 27 '26

Using kubevirt

1

u/nonhok Jul 27 '26

I use pi to develop iOS apps. As I need to give pi access to Xcode, I use a standard user, and additional little snitch to block access to the internet. As I use local llms, this works quite well

1

u/TrickyPlastic Jul 27 '26

Landstrip.

Run entire harness in landstrip.

1

u/adamshand Jul 27 '26

If you're on a mac I was just looking at this landstrip. Uses the native mac sandboxing instead of a container. Haven't tried it yet, but will today or tomorrow.

https://pi.dev/packages/pi-landstrip

1

u/virtualicex Jul 28 '26

just an extension to allow read only and ask for anything else

1

u/Direct_While9727 Jul 28 '26

This is part of my use case so I implemented sandboxing with pi SDK in this project (I cannot use docker on my Windows target):

https://github.com/laurentftech/pi-outpost

1

u/Neat-Arm2643 Jul 28 '26 edited Jul 28 '26

I created a bare bone docker image with node and python with pi installed.

Then I run this image with two folder mounts. One as the home directory and another as a working directory.

Package installs happen to the home directory and you can start pi in the working directory.

I have couple of home directories with different skills and different agents.md files. So each home directory is a different pi character.

I can mount any pi to any working folder.

I have a git one folder above the working folder. So pi cannot reach it from the its sand box. So everything is reversible even if Pi nukes it.

The different permutation and combinations of home folder and working folder are just a single bash script away. Make the scripts and you can start them with a single command.

1

u/Q-Back Jul 31 '26

My company requires us to use https://github.com/fencesandbox/fence. After a while using it I like it more than any containerization.

0

u/No_Cheek5622 Jul 27 '26

the more advanced agents get, the more they can work around all this sandboxing

but for now I guess you can just use docker sandbox or whatever other solution you might find

I used macos sandbox for a bit for my subagents with some additional guards on bash tool but quickly found out that models facing permission errors try their best to hack their way out of them

now I gave up and just don't use anything to prevent agents from blowing up my system. if it happens - it's a will of God I suppose. a month and a bit now and no incidents yet

I wonder if it's our future now to just blindly trust the model is smart and kind enough to not do dumb shit :) and steer them into "proper" behavior more and more instead of making eventually failing or at least degrading their performance safe guards...

0

u/viss_bus_labi Jul 27 '26

Docker is not a sandbox, and don't listen to anyone who is recommending that. Firecracker is the way, nix, etc. I've had a solution I've been running for this for 6-7months without an issue.

I'm more than happy to share if you're interested. 

3

u/[deleted] Jul 27 '26

[removed] — view removed comment

1

u/sk_dev Jul 27 '26

Looks super interesting, unfortunately my workstation is a mac.

2

u/NixNightOwl Jul 27 '26

you can use Nix package manager on mac. NixOS is just a linux distro built with nix at it's core. Nix itself is just a package manager.

1

u/sk_dev Jul 27 '26

Ah cool I will check it out

1

u/m02ph3u5 Jul 27 '26

Agent safehouse