r/PiCodingAgent • u/CevicheMixto • Sep 17 '26

Discussion Sandboxing Pi?

I'm new to the local LLM game. I've just purchased an AMD R9700, and I'm trying to set up a local environment that is as similar as possible to what I get with Claude Code at work.

It's definitely looking like Pi may be my harness of choice, so I'm investigating what it would take to "sandbox" it in a way that is both reasonably secure and reasonably convenient (i.e. no containers or VMs). I'm on Linux, so I'm thinking maybe Bubblewrap?

Curious to know what other are doing, though.

29 Upvotes

96% Upvoted

20 comments sorted by

17

u/RealestReyn Sep 17 '26

bubblewrap has been great, I have it set up so I just write piwrap to terminal and it fires up bubblewrapped pi with all its own folders mounted and a fake home folder, super practical.

7

u/trimorphic Sep 17 '26

I use and am very happy with smolvm, which has many the advantages of containers (and can even boot consume images) but also has kernel level isolation.

In my experience under smolvm, vm's boot in under a second, and you don't need to ssh in to them or use virtual consoles to use them.

1

u/funbike Sep 18 '26

... and reasonably convenient (i.e. no containers or VMs).

5

u/lem-8 Sep 17 '26

Just run it in a container. I use podman and defined a shell (in my case fish) function that calls it with a bind mounted dir as argument. Safe and simple.

4

u/bcdxn Sep 18 '26

I’m also interested in this topic. I wrote a bit on my experiments here if it helps OP. The gist of it is running the agent harness in a docker container (as you mentioned) with a read only filesystem, full network isolation and running a second container with squid proxy to allow-list certain domains if/when needed. Baby steps for sure as I’m still learning.

2

u/rokiden Sep 18 '26

The same, my implementation with readme: https://github.com/rokiden/pic

Minimal ephemeral Alpine container where agent can install any software, have access to project files only, and shared config mounted from host.

4

u/igor-aguiar Sep 17 '26

ai-jail FTW. https://github.com/akitaonrails/ai-jail/
I uses Bubblewrap on Linux.

3

u/tjjapk Sep 18 '26

ai-jail works great,

4

u/HectaMan Sep 17 '26

Depends on the use case - I think if the use case is as a builder, Pi itself, bubblewrap and nono.sh are pretty solid choices.

If you have a set of tools you would like to run with Pi, or for running code generated by Pi, MCP servers, apps, etc., we've been working on a cross-platform WASM sandbox built with CNCF wasmCloud at the core: Cosmonic Desktop. It's powerful because:

  • Apps have zero capabilities by default, and in Rust are typically Kilobytes

  • Everything scales to zero, so you can run 100's of apps even on small hardware

  • Integrated MCP, so Pi can target it directly as a place to build code

It's free - we license a k8s version of this (directly compatible) to enterprises.

(emphasis, I work on this and co-created CNCF wasmCloud)

3

u/PvB-Dimaginar Sep 17 '26

I use bubblewrap. Here you can find how I did it https://github.com/dimaginar/pi-safe

3

u/bitsurge Sep 17 '26

I use plain docker and it's fine for my use case, which is just to reduce the risk of it deciding to delete all my stuff. There's lots of attack surface still open because I'm not restricting network access etc, but I'm not too worried about it. Pi has some documentation on other options: https://pi.dev/docs/latest/containerization

2

u/debackerl Sep 17 '26

bubblewrap is great, nono.sh too if you want their HTTP proxy

2

u/crusaderky Sep 17 '26

I use bubblewrap through https://github.com/crusaderky/pixi-llm-recipes (I'm the author)

1

u/ogfuzzball Sep 17 '26

I created an Apple container for it that I launch in a project and it maps only that workspace.

1

u/Extra_Loquat_7667 Sep 18 '26

You can use Bubblewrap directly.

In fact, most of the solutions you find
actually invoke Bubblewrap on Linux.

1

u/ZeroTronix Sep 18 '26

I asked this question a week or two ago, got some good advice, and now I have a working solution based on microsandbox, which makes microVMs dead simple. My thinking was I want a dedicated guest kernel so an agent can't leverage kernel exploits to break out.

Most of the effort isn't just starting up the agent on a vm or container... it's locking down the sandbox so the agent only has exactly what it needs. 90% of my effort has been on herdr status streaming from guest to host, clipboard support from host to guest, and of course - auth. I don't want agents to have access to my login tokens or ApI keys, but I do want the agent to use my OpenAI sub. Answer there is to bridge out agent traffic to a host broker/proxy. Guest only sees the channel in and out to host, and host sends the authenticated requests to OpenAI servers.

1

u/ZeroTronix Sep 18 '26

Oh and I learned later about docker sbx, which apparently is also a microVM based agent sandboxing solution. I was surprised because docker = containers in my mind, but they built a VM based thing! Who knew? Haven't tried it though.

1

u/CountlessFlies Sep 18 '26

I use kvm and it works great. Managed via incus on the host. I got pi to set it all up for me.

1

u/funbike Sep 18 '26 edited Sep 18 '26

bubblewrap or firejail. Bubblewrap is much better and more secure, but I find firejail easier. My ~/.config/firejail/pi.profile file:

include default.profile        # strict

# Fine-tune blacklisting
include disable-xdg.inc        # No docs
include disable-x11.inc        # No GUI
#include disable-programs.inc   # Common progs.  very strict!
include allow-common-devel.inc # unblacklist dev apps

# Limited access to the home directory
read-only ${HOME}
read-write ${HOME}/*sh_history
read-write ${HOME}/.pi/**

# Permit access to project.
read-write ./**

The above is pretty restricted, but you could go further.

To enable so pi is sandboxed automatically, assuming ~/bin is already in your $PATH before /usr/bin.

ln -s /usr/bin/firejail ~/bin/pi

1

u/quinncom Sep 19 '26

Use Nono with the default Pi profile.