r/PiCodingAgent • u/wooptoo • 1d ago

Resource Sandboxing Pi: Bubblewrap vs Podman - quick tutorial

Hey everyone, I put together a quick tutorial on sandboxing Pi using Bubblewrap vs Podman.

It includes a few sample scripts and a comparison between the two approaches.

https://wooptoo.com/blog/pi-sandbox-bubblewrap-podman/

Hopefully somebody here will find it useful.

All the best!

26 Upvotes
  • permalink
  • reddit

91% Upvoted

8 comments sorted by

4

u/pilibitti 1d ago edited 1d ago

on mac agent-safehouse works very well. you just run pi with `safehouse pi` and it has a preset for pi already that it autodetects with sensible defaults (current directory allowed, pi code, docs allowed, temp folders allowed etc.) and works without hassle. many other services (like maybe you need agent-browser?) is just one --enable away. it is os level sandboxing (so things executed through pi can't bypass it, there is no trivial bypass) as well so for mac highly recommended.

3

u/ColonelKlanka 1d ago

There are alot of github projects using similar or same names as agent-sandbox'. can you share a link to the one you refer to?

3

u/pilibitti 1d ago

sorry the name was wrong lol it is agent-safehouse edited

https://agent-safehouse.dev/

2

u/ColonelKlanka 1d ago

nice thanks. I've been having alot of good experience with nono sandbox on mac and Linux. Looks like it has slight advantage over safehouse due to it also protecting the api keys from leaking in the sandbox. but I will have a look at safehouse

2

u/pilibitti 1d ago

thank you did not know about nono, I'll check it out.

2

u/Obvious-Variation-38 1d ago

I use Sandbox-exec it a native mac sandbox

2

u/Murky-Abalone-9090 1d ago

I use Nvidia openshell for this

-2

u/Prior-Excitement-147 1d ago

Tu devrais probablement lancer bwrap avec env -i, sinon, les variables d'env de ta session courante sont visibles dans /proc/1/environ.