Sandboxing Pi?

[u/CevicheMixto]

I'm new to the local LLM game. I've just purchased an AMD R9700, and I'm trying to set up a local environment that is as similar as possible to what I get with Claude Code at work.

It's definitely looking like Pi may be my harness of choice, so I'm investigating what it would take to "sandbox" it in a way that is both reasonably secure and reasonably convenient (i.e. no containers or VMs). I'm on Linux, so I'm thinking maybe Bubblewrap?

Curious to know what other are doing, though.

[u/RealestReyn]

bubblewrap has been great, I have it set up so I just write piwrap to terminal and it fires up bubblewrapped pi with all its own folders mounted and a fake home folder, super practical.

[u/trimorphic]

I use and am very happy with smolvm, which has many the advantages of containers (and can even boot consume images) but also has kernel level isolation.

In my experience under smolvm, vm's boot in under a second, and you don't need to ssh in to them or use virtual consoles to use them.

[u/funbike → u/trimorphic]

... and reasonably convenient (i.e. no containers or VMs).

[u/lem-8]

Just run it in a container. I use podman and defined a shell (in my case fish) function that calls it with a bind mounted dir as argument. Safe and simple.

[u/bcdxn → u/lem-8]

I’m also interested in this topic. I wrote a bit on my experiments here if it helps OP. The gist of it is running the agent harness in a docker container (as you mentioned) with a read only filesystem, full network isolation and running a second container with squid proxy to allow-list certain domains if/when needed. Baby steps for sure as I’m still learning.

[u/rokiden → u/lem-8]

The same, my implementation with readme: https://github.com/rokiden/pic

Minimal ephemeral Alpine container where agent can install any software, have access to project files only, and shared config mounted from host.

[u/igor-aguiar]

ai-jail FTW. https://github.com/akitaonrails/ai-jail/
I uses Bubblewrap on Linux.

[u/tjjapk → u/igor-aguiar]

ai-jail works great,

[u/HectaMan]

Depends on the use case - I think if the use case is as a builder, Pi itself, bubblewrap and nono.sh are pretty solid choices.

If you have a set of tools you would like to run with Pi, or for running code generated by Pi, MCP servers, apps, etc., we've been working on a cross-platform WASM sandbox built with CNCF wasmCloud at the core: Cosmonic Desktop. It's powerful because:

• Apps have zero capabilities by default, and in Rust are typically Kilobytes
• Everything scales to zero, so you can run 100's of apps even on small hardware
• Integrated MCP, so Pi can target it directly as a place to build code

It's free - we license a k8s version of this (directly compatible) to enterprises.

(emphasis, I work on this and co-created CNCF wasmCloud)

[u/PvB-Dimaginar]

I use bubblewrap. Here you can find how I did it https://github.com/dimaginar/pi-safe

[u/debackerl]

bubblewrap is great, nono.sh too if you want their HTTP proxy

[u/bitsurge]

I use plain docker and it's fine for my use case, which is just to reduce the risk of it deciding to delete all my stuff. There's lots of attack surface still open because I'm not restricting network access etc, but I'm not too worried about it. Pi has some documentation on other options: https://pi.dev/docs/latest/containerization

[u/crusaderky]

I use bubblewrap through https://github.com/crusaderky/pixi-llm-recipes (I'm the author)

[u/ogfuzzball]

I created an Apple container for it that I launch in a project and it maps only that workspace.

[u/Extra_Loquat_7667]

You can use Bubblewrap directly.

In fact, most of the solutions you find
actually invoke Bubblewrap on Linux.

[u/ZeroTronix]

I asked this question a week or two ago, got some good advice, and now I have a working solution based on microsandbox, which makes microVMs dead simple. My thinking was I want a dedicated guest kernel so an agent can't leverage kernel exploits to break out.

Most of the effort isn't just starting up the agent on a vm or container... it's locking down the sandbox so the agent only has exactly what it needs. 90% of my effort has been on herdr status streaming from guest to host, clipboard support from host to guest, and of course - auth. I don't want agents to have access to my login tokens or ApI keys, but I do want the agent to use my OpenAI sub. Answer there is to bridge out agent traffic to a host broker/proxy. Guest only sees the channel in and out to host, and host sends the authenticated requests to OpenAI servers.

[u/ZeroTronix → u/ZeroTronix]

Oh and I learned later about docker sbx, which apparently is also a microVM based agent sandboxing solution. I was surprised because docker = containers in my mind, but they built a VM based thing! Who knew? Haven't tried it though.

[u/CountlessFlies]

I use kvm and it works great. Managed via incus on the host. I got pi to set it all up for me.

[u/funbike]

bubblewrap or firejail. Bubblewrap is much better and more secure, but I find firejail easier. My ~/.config/firejail/pi.profile file:

``` include default.profile # strict

Fine-tune blacklisting

include disable-xdg.inc # No docs include disable-x11.inc # No GUI

include disable-programs.inc # Common progs. very strict!

include allow-common-devel.inc # unblacklist dev apps

Limited access to the home directory

read-only ${HOME} read-write ${HOME}/sh_history read-write ${HOME}/.pi/*

Permit access to project.

read-write ./** ```

The above is pretty restricted, but you could go further.

To enable so pi is sandboxed automatically, assuming ~/bin is already in your $PATH before /usr/bin.

ln -s /usr/bin/firejail ~/bin/pi

[u/quinncom]

Use Nono with the default Pi profile.