Hacker News Reader

Comment by Onavo | Hacker News Reader

The biggest issue with Pi is that they don't have proper sandboxing with auto approval. Most solutions are third party and half baked. You have to either choose between just auto approval (no sandboxing), or a Claude/Codex style sandbox but manual approval.

View on HN

Hi -

I wrote a piece about this here: https://ptgamr.substack.com/p/a-pi-setup-with-permission-san...

It is a combination of 3 extensions.

I managed to get the sandbox working, and the option to break out of sandbox (with approval).

The network sandboxing doesn't work yet (I don't want malicious script to be execute and exfiltrate the data), I created an issue here: https://github.com/erichll/pi-packages/issues/1 - might submit a PR once I get a reply.

I started treating my developer workstations like cattle. With a press of a button I can turn a vanilla Ubuntu 22.04.04 server install into my happy-place developer environment. Tools, code, browser -- everything set up exactly the way I want it. I have it synced to a couple of different laptops, and a separate boot drive from my desktop machine. It has a restricted set of SSH keys, and I push code to a separate upstream.

If YOLO MODE causes pi to destroy my workstation (it hasn't yet) I'll just nuke the thing from orbit and spin up a new one.

You might appreciate https://nono.sh/

Its very easy to use and has a pre-made profile for pi. Just do something like `alias pi="nono run -v --profile pi --allow-cwd -- /opt/homebrew/bin/pi"` in your shell.

Correct. pi.dev is not a minimal coding agent. It already comes with crazy amounts of preconceptions baked in.

For example, it comes with a bash tool built that you cannot disable. This is not minimal, it's the full kitchen sink. If I want to build a custom agent I have to literally stop using pi.dev and switch to something else.

So yeah, I fully disagree with the title. "Pi’s Minimalism Is Its Advantage" No. full stop. It's too bloated for me already. It's not minimal enough. If it's minimalism was its strength. it might not even need a sandbox, because it can't run bash commands or update files to begin with.

you can just use the --tools flag to disable bash tool

The secret here is giving pi its own user account on your machine, using Unix permissions.

It doesn't do auto approval.

My very first request, after reading this thread and deciding to try pi out--it went out of the app directory it started in, and made code edits to a sibling directory in a different git project repo.

opencode has never done that.

I'm allured by the minimalism, so I didn't quit there, but I'm not keen on letting it loose with vague instructions, that's for sure.

I've been satisfied with using Pi inside of srt [0].

I launch with `srt pi` and get file system and network isolation. There is a seemingly infinite risk surface area to protect, but I think does a reasonable job of balancing security and convenience.

I've also heard good things about nono [1] from colleagues, but I haven't personally tried it out yet.

[0] https://github.com/anthropic-experimental/sandbox-runtime

[1] https://github.com/nolabs-ai/nono

Yeah, I think Pi is good to use now because the AI has became so good that they almost can run on their own. Previously, AI agents do so many dumb and expected things that I really didn’t want to let them run on a loose leash and manual+automatic approval helped me steer them better. Even now, sometimes agents in Pi do things that startled me when I realized I didn’t explicitly approve that!

I don't really want to do approvals though. Either I put stuff into a real sandbox, or #yolo

This is also by design. Pi assumes you’re a power user and you know what you you’re doing and what you want. If sandboxing and the security that Claude and codex offer is something you truly need, pi might not be for you and that’s okay.

This is backwards. If you're a power user you want full control over all the tools granted to the agent and not let the agent bypass them by using bash. It's the people who don't want to customize anything that don't care about letting the agent go haywire and just run whatever bash commands it needs in a sandbox.

Think about why a sandbox is needed: Your permissions have been too loose. You now need to deal with the fallout of your decision externally. If all the agent was allowed to do is read your files and run cargo test, you wouldn't need a sandbox at all, the agent is the sandbox.

Now you might say, but what if it needs to modify files? If you wanted to build a sandbox or approval workflow here, you'd put it right into your custom write tool. It could be an extension you just download so you can pick your favorite write tool. Instead, the authors of pi.dev chose the worst possible defaults.

Power users don't want sandboxing and security??

You have a wildly different understanding of what a power user is...

Or you could do any of the things they suggest in their documentation: https://pi.dev/docs/latest/security#running-untrusted-or-unm...

It's not like there isn't competition in this space.

Like I said, it's okay if you need those things. Pi might not be for your use-case and that's okay, too.

I find pi-sandbox works well for me. Did you evaluate pi-sandbox? If not, give it a try.

Yes, I wrote a piece about it here: https://ptgamr.substack.com/p/a-pi-setup-with-permission-san...

It is actually a combination of 3 extensions

I just run it as a separate Unix user. Good enough for me.

Reply on news.ycombinator.com