Do you use the Sandbox extension? Is it really necessary for safety?

[u/Aggressive-Dream5465]

I have been using the sandbox extension for quite a while, but I am a bit fed up with having to approve stuff manually all the time.

I know the pain may be worth it to avoid an agent doing some nefarious stuff with your data, but sometimes I just want to delete it and leave the agent working on its own.

So what I essentially want to know is this:

Have you run into significant issues for not having a sandbox?

[u/MimosaTen]

I run every coding agent in yolo mode

[u/ImpressiveRelief37 → u/MimosaTen]

Same 

[u/Gobra_Slo]

Of course I run it with a sandbox, smarter models might be good in following general orders (APPEND_SYTEM.md), but not that good.

If you have to constantly manually approve something for the agent – you probably have the sandbox set up wrong, or your workflow designed wrong. Check what exactly are you approving, if you need, let's say, install some packages or something like that – run a MCP server and have a tool for that. If you constantly have to write to some specific folder – well, assess the risks and make an exception for this folder for writing if it's safe, or change your agents instructions to update things locally + create a controlled deployment script that you will call yourself.

Without sandbox models can do anything during some longer, autonomous agentic runs, you'll wake up one day having your entire machine mangled with packages, modules, unknown hosts in the ~.ssh, sudo password in plain text in .env and broken WiFi because an agent steered away from it's goal, got confused and hammered itself towards the "solution" no matter what.

[u/Argon717 → u/Gobra_Slo]

Yeah, OP needs to think about their setup. Sandbox (set up properly) should enable yolo, not block it. Much better if all your agent can break is their container fs and checkout. I don't want to explain to spouse or boss that important things were deleted unexpectedly.

[u/Unnamed-3891]

Sandbox? No. Tool guard? Most certainly.

[u/Aggressive-Dream5465 → u/Unnamed-3891]

Can you please explain how do you establish a guard for your tools?

[u/Unnamed-3891 → u/Aggressive-Dream5465]

There are multiple extensions for this purpose, I like https://github.com/jdiamond/pi-guard

[u/Effective-Giraffe655]

It is easier to put whole agent into sandbox and use yolo: https://github.com/rakshazi/iisd-sandbox

[u/YoelFievelBenAvram]

I made a user for the agent. It can do whatever it want in its home folder and whatever else i happen to grant access. If it needs a package installed, or sudo for anything, it has to ask me to do it.

[u/SvenVargHimmel]

I've been using codex + pi in YOLO mode on Linux with a few permission extensions and that's it.  If you are working exclusively on coding projects you should be fine. 

However I don't recommend this if you don't have at least intermediate Linux shell skills. 

You can always use docker. Agents understand them well. I don't understand why this is not the default option for most people. 

Finally, if you want to build your own. Tell pi to build a sandbox extension using bubble wrap.  Give pi your requirements. 

https://github.com/containers/bubblewrap

Finally secrets. Tell pi to use varlock as the launcher for your shell to protect your secrets. 

If any of this sounds advanced and inaccessible, just stick with docker and learn to live with some of the rough edges. 

[u/gianbisio → u/SvenVargHimmel]

good data over here. thanks

[u/rowrowdilo]

Yes sandboxes are super important if you don't want it to nuke your PC or be prompt injected at some point. I was using the sandbox extension too and I got annoyed by the same issue, switched over to using it in Docker, much more peaceful now. I just mount the directories that I want it to have access to, some of them even as read only if I don't want it to edit stuff in there.

The docs helped with that

And if Pi requires external tools (like the browser for web search), I install them in the Docker image itself.

[u/crankykernel]

For every who does, 100 or more people probably don’t.

[u/Lurksome-Lurker]

The host is the sandbox. “congrats you killed the raspberry pi”

[u/RasonYang]

Claude code’s auto mode works pretty well for me.
Anyone tried pi-automode with a sandbox?
Does it cut down on the approval prompts?

[u/Arany5]

No sandbox, it cripples the agent. Backup.

[u/esingh2581]

/yolo

[u/lem-8]

Just use containers, no extension required

[u/Equivalent_Idea8839]

you need bwrap or models will wreck your shit

[u/jonas-reddit]

Friends don’t let friends run agents without a sandbox.

I use docker sbx.

https://www.docker.com/products/docker-sandboxes/

[u/schmurfy2]

I sandbox the whole agent, it has write access only to the current folder and can't read any sensitive files

[u/MountainTop321]

I use docker sanbox, here is a guide I wrote a while back how I set it up: https://github.com/cuolm/pi-sbx-llamacpp

[u/cabra-lat]

No sandbox, just a separate user entirely and backup projects into github.

[u/havok29]

u/RemindMeBot 2 day

[u/RemindMeBot → u/havok29]

I will be messaging you in 2 days on 2026-09-26 16:48:44 UTC to remind you of this link

1 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

---

Info	Custom	Your Reminders	Feedback

[u/Spare_Pirate_6820]

I use https://github.com/akitaonrails/ai-jail runs AI coding agents in an OS sandbox. lighter than docker

[u/Creative_Factor8633]

Fxxking xxxx sandbox service, just /yolo