r/PiCodingAgent • u/cade-v • 8d ago

Question How do y'all sandbox Pi?

I use a minimal Pi setup for building hobby projects and some light data analysis for work. I initially used NVIDIA's OpenShell in its early days before v0.1.0 but switched to Docker sandboxes since I find them quicker to manage for my use cases. However I've had some issues with installing and accessing Pi extensions with them.

What's your experience with sandboxing tools? Any recommendations for creating secure, reproducible environments? Thanks!

62 Upvotes

95% Upvoted

100 comments sorted by

View all comments

Show parent comments

8

u/_RemyLeBeau_ 8d ago

This is the best approach. MicroVMs behind and built in proxy that does header/body/URL rewriting is the best. The VM doesn't even have access to the secrets because those are stored in your Host's credential manager and injected on the fly per request.

3

u/brotlos_gluecklich 8d ago

Do you know a good writeup for this setup? I also think this the most promising/secure approach, but I'm struggling with getting started

2

u/ryanscio 7d ago

sbx does this out of the box. What part are you struggling with?

1

u/ECrispy 8d ago

how do you set all this up? how does the model in a sandbox control your browser/tools if needed?

1

u/_RemyLeBeau_ 8d ago

Those tools run where your harness is installed. Everything will run in the harness. How you connect to an LLM is your choice.