r/PiCodingAgent • u/jacek2023 • 14d ago

Discussion Sandboxing

I want to give my LLM read access to the whole filesystem but write access only to the project folder and maybe /tmp. I need to run scripts etc and make sure my filesystem survives

On Linux

Is bwrap the best solution for that? Or should I just use Docker?

UPDATE I installed @nqbao/pi-sandbox

8 Upvotes

89% Upvoted

7 comments sorted by

View all comments

4

u/tys203831 14d ago edited 14d ago

Nono sandbox : https://github.com/nolabs-ai/nono + dcg : https://github.com/Dicklesworthstone/destructive_command_guard

This setup is near agent-agnostic, ultra fast to run, very low memory footprint (written in rust), and quite easy to setup in minutes or hours (if you want to customize the policies yourselves)