Pi went searching across my entire home directory unprompted... Idk to do that without some kind of sandboxing builtin is rough and chews through tokens on things I don't really want polluting my context.
replyA coworker of mine has a pretty neat script that uses bubblewrap to wrap any application. I'm using that one too for pi and it's pretty great since you don't have to trust the harness and can quite easily customize the sandbox to your needs, e.g. disallow reading to certain directories etc.
replyThis blogpost describes a similar thing: https://bxt.rs/blog/easy-sandboxing-on-linux-with-bubblewrap...
Well yeah, it's YOLO-by-default by design. That's not related to upgrade churn.
reply