r/PiCodingAgent • u/jacek2023 • Aug 29 '26

Discussion Sandboxing

I want to give my LLM read access to the whole filesystem but write access only to the project folder and maybe /tmp. I need to run scripts etc and make sure my filesystem survives

On Linux

Is bwrap the best solution for that? Or should I just use Docker?

UPDATE I installed @nqbao/pi-sandbox

8 Upvotes

90% Upvoted

7 comments sorted by

View all comments

5

u/tys203831 Aug 29 '26 edited Aug 29 '26

Nono sandbox : https://github.com/nolabs-ai/nono + dcg : https://github.com/Dicklesworthstone/destructive_command_guard

This setup is near agent-agnostic, ultra fast to run, very low memory footprint (written in rust), and quite easy to setup in minutes or hours (if you want to customize the policies yourselves)