I have a couple hundred line TUI that just clones an LXD container and I get all my repos and infra isolated in 5s with pi having isolation to that container. Swap between any instance. Port forward to host all automatic.
replyFunny to me how stuff is described these days. Seems like some people lack the full understanding of all these different systems and really overcomplicate their harness setups or use super bloated all in one tooling.
I tried putting my agent in an LXC / Incus container but then I also needed it to process videos stored on a NAS, and that was not easy at all. I tried a FUSE-based NFS client [1] but it was very flaky and would randomly report files having zero length and fail processing.
replyDo you have any links that would explain this?
replyI'm looking at changing my AI harness and am definitely interested in this
You can sandbox with tool hooks, at least in antigravity, I think a lot of other harnesses support similar features. Sandboxing via the prompt is just dangerous and unreliable.
replyThe developers of pi.dev are geniuses.
replyThey add a --tools flag, which can only add tools onto the built-in tools, so if you wanted to sandbox pi.dev by adding sandboxed versions of the existing tools you will have to run pi.dev via
pi --no-tools --tools tool1, tool2, tool3
So if you want to sandbox your agent, guess what you'll have to do? Yep, you have to supply --no-extensions.
Here is how to run pi.dev under its most minimal configuration under a sandbox:
pi --no-tools --no-extensions --tools tool1, tool2, tool3 -e ./your-sandboxing-extension