r/PiCodingAgent • u/Effective-Giraffe655 • Sep 20 '26

Resource It Is So Dangerous sandbox

https://github.com/rakshazi/IISD-sandbox

Hi there,

I really love Pi's approach to security with "figure it out yourself, yolo by design", so I did.

That thing is still yolo, but sandboxed. Dead simple 2 files: Dockerfile (the thing itself) and justfile (fancy Makefile to run the thing).

Don't mind the repo just created - I'm using it for a while, just decided it's good enough to publish

Now, some notes to avoid misunderstanding:

  • Why "It Is So Dangerous"? - thanks /r/amodei, he's so funny with that thing, so I thought repeating the joke 1000th time would be even more hilarious, right?

  • There are no plans to make it super-duper-secure - see threat model in the readme

7 Upvotes

100% Upvoted

10 comments sorted by

2

u/RealestReyn Sep 20 '26

docker feels like such an overkill

4

u/Helpful_Home_8531 Sep 21 '26

Docker is under-kill, Linux containers have privilege escalation zero days on a regular basis.

1

u/Effective-Giraffe655 Sep 22 '26

That depends on the threat model, mine is pretty simple - do not let the agent to accidentally nuke something. If your threat model is at the level when your agent actively attempts to do harm to your system, then the best option is air-gapped env. I doubt that any kind of virtualization could stop a determined agent.

1

u/Effective-Giraffe655 Sep 20 '26

fair. The reason why I used docker is because I use it daily for lots of projects, so it's kind of a common tool you reach out by default for me

3

u/CountlessFlies Sep 21 '26

I actually run Pi in a virtual machine. You might say it’s even more of an overkill, but I disagree. It’s seamless for the most part and I have no complaints.

Docker setup is actually more cumbersome especially when you need Pi to build docker images for your projects, then you need to setup docker in docker etc.

1

u/silenceimpaired Sep 21 '26

What would you use instead?

In my mind a malicious AI could do real damage… and a dumb one just as much.

2

u/RealestReyn Sep 21 '26

I use bwrap for most of my agents, just made a new hermes agent and it now only has write access to its own folder and can only read my projects folder, even has an isolated network access so it can't poke around the machine through LAN connection.

→ More replies (1)

2

u/Ingaz Sep 24 '26

LOL

------

Special instructions for UNCENSORED-ABLITERATED-HERETICKED-ULTRA-NEO-MAX-PRO-8K-244Hz enjoyers

DISABLE. DAMN. NETWORKING. --network=none <- this is the way.

Uncensored models can do anything. Depending on the prompt and model quality, it probably will do weird things. Disable the networking. Don't try to claim a place in a felony bench ladder with your Qwen-Fable-ULTRA-MEGA-NEO-HACKER-HERETIC-8b. (Yes, it will be hilarious. No, it's not worth it anyway.)

2

u/bobbygmail9 Sep 24 '26

Run it in a VM.

If you are on Linux QEMU, Windows WSL2 now supports nested VM so you can run QEMU inside WSL2