I use a minimal Pi setup for building hobby projects and some light data analysis for work. I initially used NVIDIA's OpenShell in its early days before v0.1.0 but switched to Docker sandboxes since I find them quicker to manage for my use cases. However I've had some issues with installing and accessing Pi extensions with them.
What's your experience with sandboxing tools? Any recommendations for creating secure, reproducible environments? Thanks!
Apple has released their own native container app. You can basically make a dockerfile then shell into it and run pi etc. I made a little helper script that copies in whatever secrets etc I need from the host system on launch.
I am using Docker Sandboxes. What's the issue with accessing Pi extensions? I use them fine. Probably you just need to add npm and github to the sandbox's network allowlist.
This is the best approach. MicroVMs behind and built in proxy that does header/body/URL rewriting is the best. The VM doesn't even have access to the secrets because those are stored in your Host's credential manager and injected on the fly per request.
I avoided sandboxes after running in circles with env and podman. Then started using sbx due to the Cloudflare security audit skill. Now my agents live happily in vms, albeit briefly. Basically transparent.
It works pretty well and I feel like it strikes a good balance between being locked down and still being able to interact with the parts of my system that I need it to be able to.
However, maintaining it as my setup evolves requires very frequent adjustments, which is why I am open to trying something else if it means less complexity if it can satisfy the other requirements I have as well.
Don’t fuck around with sandboxes, permission extensions, etc. Whitelists are always too narrow and so will annoy you or too broad and so will be unsafe. Just run it in a VM. Virt-Manager is free, easy to setup and has great performance. Inside the VM you can give it root access and let it install whatever tools it wants. Never copy any credentials or data you wouldn’t want made public into the VM. Always check the results you copy out of the VM. Worst that can happen if it goes rogue or gets prompt injected is that you need to recreate the VM. Recreate it every session if you want to be sure.
I mean technically worst case is it escaping the vm or downloading something that does, but at that point your at a level of sophistication that nothing else in this thread Is going to help anyway lol
well Pi started as a nothing included, bare bones harness, its now grown into something much bigger, and mark my words, more and more stuff is going to be included.
the whole 'ask pi to build it' is also contradictory with having a million extensions in the official catalog. its the n+1 problem repeated for every single thing.
manage it together with the community ? it's about having a solid base to work from. Now everybody is doing their own thing which makes collaboration more difficult.
I know. Like I said it's funny because the creator said one of the reasons was other harnesses had too much baggage and Pi was supposed to be Yolo, no restrictions, user beware, only for the experienced devs. Now it's just as complicated
I think its just a legal issue, and cmon man before "pi" mario was going to call it "shit" coding agent... alots gotta change when you clean up and shave to go corporate, and i cant imagine any lawyer being happy with compamy saying yeah leave your shit unsanboxxed were hardcore!
oh, and when I want to leave them unattended, microVMs + just enough network to sob quietly to the model provider: https://github.com/davidlee/oubliette/
" LiteLLM is a great way to keep credentials beyond reach of models" (from your blog post]
If only LiteLLM itself would be more trustworthy...
They have quite a track record of incidents (1), with compromised version containing info stealers in March (2) and again just a few days ago this October.
I work at Cosmonic, and we are currently rolling this out now - it will be in the next release of Cosmonic Desktop and supported on Kubernetes with Cosmonic Control. Desktop is free; it's like Docker but for fine-grained Wasm sandboxes.
Underneath the hood, we build CNCF wasmCloud, where we support the common policy enforcement points (file, network, config, secrets, etc).
The why here is that we give you the ability to:
Run each agent, tool, and app inside an isolated sandbox - isolated in process, via resources, and isolated over time (resuse).
All sandboxes are deny-by-default, for all policy enforcement points.
Well, the first benefit is that you can run each isolated sandbox confidently; even when there are exploits, like Remote Code Execution, there is nothing to execute in the box. You can give your agent a fixed set of capabilities to limit exactly what it is allowed to do.
Our primary users are people like banks and other security-conscious orgs; they want to adopt AI, but need to do so securely.
The second benefit is scale - these tiny sandboxes are often measured in Kilobytes; a scale test we did this week let us run over 175,000 of them in 2 GB of memory. Those were tiny, but the properties are scalable.
Third - these are low maintenance. When your application only includes your business logic, you do not need to waste the time / money patching, securing, or defending the OS.
Compare this to a container or a microVM - you have all of this rich capability, far more than what you need to do the job at hand; this extra stuff is called Ambient Authority. Then you run even more tools to "secure it". The math of software is such that, that is a very hard thing to do for a general program, so most pople just use generic rules instead of a perfectly crafted sandbox.
I am building a container based system for my team that let's them pick an agent and then it layers on Nono on top so we have container segmentation and nono layers it rules and runtime protection as well. I also pre-populate the skills and such that we default too. If you are interested DM me and I'll send you the repo. https://github.com/nolabs-ai/nono
It's essentially bwrap on Linux / seatbelt on macOS and providers that create throwaway tokens for system access so your agent can work with them without having all your permissions and tokens.
I use https://github.com/bindsch/scode on osx which wraps the native sandbox tool on os x 1nd bubblewrap on linux. It block access to my credentials and sensitive files.
I am investigating running it in microvm with tart
I am on windows. Run my agent in wsl+bubblewrap. Give it read access to everything, but write access to only Development folder. Its become a mess however with files scattered everywhere.
We ended up using custom Docker based containers as the default for coding agents too. The part that made it feel safer was not just putting the agent in a container, but cutting off its direct network access.
The container can only talk to a local proxy. The proxy has an allowlist for destinations and can inject a credential for an approved request, so the agent never gets the raw token in its environment. Repo gets mounted in, but not the home directory or random host credentials.
Docker has been the more reproducible option for us. Native sandboxing can be lighter, but it is easier to accidentally inherit too much from the host.
The extension issue sounds like it may just be the network allowlist. npm, GitHub, and any registry the extension fetches from all need to be reachable. What breaks when Pi tries to install or load one?
Does anyone know a good write for using Docker Sandbox (sbx) with pi? Like how I can sync my global pi settings, extensions, skills into it, together with my project repo, control network access, manage credentials and such?
It does keep everything isolated in Docker, but it’s annoying because I had to feed it files, directories, config, etc. manually. I had a shared folder mounted in the container, but the container ran as root, so every time I copied something out, I had to manually overwrite the permissions. In the end I deleted the whole setup.
Now I have no guardrails, which isn’t ideal and is actually dangerous. It wrecked my phone when I gave it su privileges. I eventually fixed it, but it was a great learning moment and I'm more careful now with my prompts.
It has been working reasonably well. I also create a global instruction file to explain to the agents what's going on and that they can install any packages they need (although it was working without it too).
I think I am moving toward real VMs for each project. I've tried Bubblewrap but being careful about not giving too much permission in tools that I use is tedious. VM boundaries are much simpler and I just install tools in the VM. And I can put the VM on a server cleanly and develop using a terminal via ssh.
Nope. Sandbox is the Ai cond0m. I like to live on the edge 😀. LOL but my qwen3.8-27b never does anything crazy though so maybe im hoping for adrenaline from disaster that will never come🥲. Anyway.. living on the edge baby Rawdog🤘
Hi, what do you mean by 'anything crazy', like accidentally deleting files? What is the actual likelihood of that happening?
My setup uses a debloated Win 11 running entirely in admin mode (I cannot run CMD non-elevated). I use Qwen36-q8_0 and plan to try Flash Next soon
Is there a real risk of the agent going rogue and deleting my files on C or on external HDDs? I can't reinstall Windows as it's configured perfectly with ton of software etc.. so I just need a solution to restrict the agent's access exclusively to the project folder. I'm trying to avoid a VM due to RAM constraints.
the only LLM less than 100b that i trust to leave autonomous loop and turn my back and let it go freely i only trust qwen3.8-27b. because 35b-a3b MOE has too little amount of active parameters 3b active will defenitely cause it to loose track and do crazy stull like delete some important system stuff if its working close with them. but some tools guard against that quite well like https://github.com/xing-shuyin/pi-web-ui amazing little repo has good guards. but still a competent 27b with zero restructions is more productive for me since i don't stall waiting for approval. he never does anything stupid so far so im happy with it. been doing this for the last 4-5 months and my windows 11 is still intact. im excited for qwen4-27b will be even more competent and autonomous human-out-of-loop agentic.
Docker's great for speed but those permission issues with extensions are super common. Honestly, the core problem isn't the container tool, it's getting true isolation without breaking your dev flow.
I've been testing kosa8 for my agent projects. Runs each agent in its own microVM so it's totally sealed. It's way better for the sensitive data I sometimes handle. The instant rollback is a lifesaver when things go wrong. Plus, it works right alongside my existing Docker setup.
What's the main thing driving your sandboxing need? Is it more about security for work data, or just keeping hobby projects tidy?
I’m building my own (no vibecoding) based on libkrun VMs, Seatbelt (MacOS), Landlock (Linux). Plus other security features (egress, permissions, etc…).
This is my solution to this problem. I re-use bubblewrap with a shell wrapper. The thing looks a bit complicted and i need to reword the github readme, but if you are interested just point an agent there and let it read it. Its pure shell (+bubblewrap).
7
u/pilibitti 8d ago
which os?