3 ms·

The biggest issue with Pi is that they don't have proper sandboxing with auto approval. Most solutions are third party and half baked. You have to either choose

by Onavo 2mo ago

The biggest issue with Pi is that they don't have proper sandboxing with auto approval. Most solutions are third party and half baked. You have to either choose between just auto approval (no sandboxing), or a Claude/Codex style sandbox but manual approval.

pavo-etc 2mo ago
The secret here is giving pi its own user account on your machine, using Unix permissions.
- Onavo 2mo ago
  It doesn't do auto approval.
spudlyo 2mo ago
I started treating my developer workstations like cattle. With a press of a button I can turn a vanilla Ubuntu 22.04.04 server install into my happy-place developer environment. Tools, code, browser -- everything set up exactly the way I want it. I have it synced to a couple of different laptops, and a separate boot drive from my desktop machine. It has a restricted set of SSH keys, and I push code to a separate upstream. If YOLO MODE causes pi to destroy my workstation (it hasn't yet) I'll just nuke the thing from orbit and spin up a new one.
josh_p 2mo ago
This is also by design. Pi assumes you’re a power user and you know what you you’re doing and what you want. If sandboxing and the security that Claude and codex offer is something you truly need, pi might not be for you and that’s okay.
- imtringued 2mo ago
  This is backwards. If you're a power user you want full control over all the tools granted to the agent and not let the agent bypass them by using bash. It's the people who don't want to customize anything that don't care about letting the agent go haywire and just run whatever bash commands it needs in a sandbox. Think about why a sandbox is needed: Your permissions have been too loose. You now need to deal with the fallout of your decision externally. If all the agent was allowed to do is read your files and run cargo test, you wouldn't need a sandbox at all, the agent is the sandbox. Now you might say, but what if it needs to modify files? If you wanted to build a sandbox or approval workflow here, you'd put it right into your custom write tool. It could be an extension you just download so you can pick your favorite write tool. Instead, the authors of pi.dev chose the worst possible defaults.
- BoiledCabbage 2mo ago
  Power users don't want sandboxing and security?? You have a wildly different understanding of what a power user is...
  - josh_p 2mo ago
    Or you could do any of the things they suggest in their documentation: https://pi.dev/docs/latest/security#running-untrusted-or-unmonitored-work https://pi.dev/docs/latest/security#running-untrusted-or-unm... It's not like there isn't competition in this space. Like I said, it's okay if you need those things. Pi might not be for your use-case and that's okay, too.
frogperson 2mo ago
You might appreciate https://nono.sh/ https://nono.sh/ Its very easy to use and has a pre-made profile for pi. Just do something like `alias pi="nono run -v --profile pi --allow-cwd -- /opt/homebrew/bin/pi"` in your shell.
- imtringued 2mo ago
  [dead]
sejje 2mo ago
My very first request, after reading this thread and deciding to try pi out--it went out of the app directory it started in, and made code edits to a sibling directory in a different git project repo. opencode has never done that. I'm allured by the minimalism, so I didn't quit there, but I'm not keen on letting it loose with vague instructions, that's for sure.
sinuhe69 2mo ago
Yeah, I think Pi is good to use now because the AI has became so good that they almost can run on their own. Previously, AI agents do so many dumb and expected things that I really didn’t want to let them run on a loose leash and manual+automatic approval helped me steer them better. Even now, sometimes agents in Pi do things that startled me when I realized I didn’t explicitly approve that!
klooney 2mo ago
I don't really want to do approvals though. Either I put stuff into a real sandbox, or #yolo
imtringued 2mo ago
Correct. pi.dev is not a minimal coding agent. It already comes with crazy amounts of preconceptions baked in. For example, it comes with a bash tool built that you cannot disable. This is not minimal, it's the full kitchen sink. If I want to build a custom agent I have to literally stop using pi.dev and switch to something else. So yeah, I fully disagree with the title. "Pi’s Minimalism Is Its Advantage" No. full stop. It's too bloated for me already. It's not minimal enough. If it's minimalism was its strength. it might not even need a sandbox, because it can't run bash commands or update files to begin with.
- la_fayette 2mo ago
  you can just use the --tools flag to disable bash tool
myaccountonhn 2mo ago
I just run it as a separate Unix user. Good enough for me.
thehours 2mo ago
I've been satisfied with using Pi inside of srt [0]. I launch with `srt pi` and get file system and network isolation. There is a seemingly infinite risk surface area to protect, but I think does a reasonable job of balancing security and convenience. I've also heard good things about nono [1] from colleagues, but I haven't personally tried it out yet. [0] https://github.com/anthropic-experimental/sandbox-runtime https://github.com/anthropic-experimental/sandbox-runtime [1] https://github.com/nolabs-ai/nono https://github.com/nolabs-ai/nono
mark_l_watson 2mo ago
I find pi-sandbox works well for me. Did you evaluate pi-sandbox? If not, give it a try.
- ptgamr 1mo ago
  Yes, I wrote a piece about it here: https://ptgamr.substack.com/p/a-pi-setup-with-permission-sandbox https://ptgamr.substack.com/p/a-pi-setup-with-permission-san... It is actually a combination of 3 extensions
ptgamr 1mo ago
Hi - I wrote a piece about this here: https://ptgamr.substack.com/p/a-pi-setup-with-permission-sandbox https://ptgamr.substack.com/p/a-pi-setup-with-permission-san... It is a combination of 3 extensions. I managed to get the sandbox working, and the option to break out of sandbox (with approval). The network sandboxing doesn't work yet (I don't want malicious script to be execute and exfiltrate the data), I created an issue here: https://github.com/erichll/pi-packages/issues/1 https://github.com/erichll/pi-packages/issues/1 - might submit a PR once I get a reply.

by Onavo 2mo ago

pavo-etc 2mo ago

The secret here is giving pi its own user account on your machine, using Unix permissions.

Onavo 2mo ago
It doesn't do auto approval.

spudlyo 2mo ago

I started treating my developer workstations like cattle. With a press of a button I can turn a vanilla Ubuntu 22.04.04 server install into my happy-place developer environment. Tools, code, browser -- everything set up exactly the way I want it. I have it synced to a couple of different laptops, and a separate boot drive from my desktop machine. It has a restricted set of SSH keys, and I push code to a separate upstream. If YOLO MODE causes pi to destroy my workstation (it hasn't yet) I'll just nuke the thing from orbit and spin up a new one.

josh_p 2mo ago

This is also by design. Pi assumes you’re a power user and you know what you you’re doing and what you want. If sandboxing and the security that Claude and codex offer is something you truly need, pi might not be for you and that’s okay.

imtringued 2mo ago
This is backwards. If you're a power user you want full control over all the tools granted to the agent and not let the agent bypass them by using bash. It's the people who don't want to customize anything that don't care about letting the agent go haywire and just run whatever bash commands it needs in a sandbox. Think about why a sandbox is needed: Your permissions have been too loose. You now need to deal with the fallout of your decision externally. If all the agent was allowed to do is read your files and run cargo test, you wouldn't need a sandbox at all, the agent is the sandbox. Now you might say, but what if it needs to modify files? If you wanted to build a sandbox or approval workflow here, you'd put it right into your custom write tool. It could be an extension you just download so you can pick your favorite write tool. Instead, the authors of pi.dev chose the worst possible defaults.
BoiledCabbage 2mo ago
Power users don't want sandboxing and security?? You have a wildly different understanding of what a power user is...
- josh_p 2mo ago
  Or you could do any of the things they suggest in their documentation: https://pi.dev/docs/latest/security#running-untrusted-or-unmonitored-work https://pi.dev/docs/latest/security#running-untrusted-or-unm... It's not like there isn't competition in this space. Like I said, it's okay if you need those things. Pi might not be for your use-case and that's okay, too.

frogperson 2mo ago

You might appreciate https://nono.sh/ https://nono.sh/ Its very easy to use and has a pre-made profile for pi. Just do something like `alias pi="nono run -v --profile pi --allow-cwd -- /opt/homebrew/bin/pi"` in your shell.

imtringued 2mo ago
[dead]

sejje 2mo ago

My very first request, after reading this thread and deciding to try pi out--it went out of the app directory it started in, and made code edits to a sibling directory in a different git project repo. opencode has never done that. I'm allured by the minimalism, so I didn't quit there, but I'm not keen on letting it loose with vague instructions, that's for sure.

sinuhe69 2mo ago

Yeah, I think Pi is good to use now because the AI has became so good that they almost can run on their own. Previously, AI agents do so many dumb and expected things that I really didn’t want to let them run on a loose leash and manual+automatic approval helped me steer them better. Even now, sometimes agents in Pi do things that startled me when I realized I didn’t explicitly approve that!

klooney 2mo ago

I don't really want to do approvals though. Either I put stuff into a real sandbox, or #yolo

imtringued 2mo ago

Correct. pi.dev is not a minimal coding agent. It already comes with crazy amounts of preconceptions baked in. For example, it comes with a bash tool built that you cannot disable. This is not minimal, it's the full kitchen sink. If I want to build a custom agent I have to literally stop using pi.dev and switch to something else. So yeah, I fully disagree with the title. "Pi’s Minimalism Is Its Advantage" No. full stop. It's too bloated for me already. It's not minimal enough. If it's minimalism was its strength. it might not even need a sandbox, because it can't run bash commands or update files to begin with.

la_fayette 2mo ago
you can just use the --tools flag to disable bash tool

myaccountonhn 2mo ago

I just run it as a separate Unix user. Good enough for me.

thehours 2mo ago

I've been satisfied with using Pi inside of srt [0]. I launch with `srt pi` and get file system and network isolation. There is a seemingly infinite risk surface area to protect, but I think does a reasonable job of balancing security and convenience. I've also heard good things about nono [1] from colleagues, but I haven't personally tried it out yet. [0] https://github.com/anthropic-experimental/sandbox-runtime https://github.com/anthropic-experimental/sandbox-runtime [1] https://github.com/nolabs-ai/nono https://github.com/nolabs-ai/nono

mark_l_watson 2mo ago

I find pi-sandbox works well for me. Did you evaluate pi-sandbox? If not, give it a try.

ptgamr 1mo ago
Yes, I wrote a piece about it here: https://ptgamr.substack.com/p/a-pi-setup-with-permission-sandbox https://ptgamr.substack.com/p/a-pi-setup-with-permission-san... It is actually a combination of 3 extensions

ptgamr 1mo ago

Hi - I wrote a piece about this here: https://ptgamr.substack.com/p/a-pi-setup-with-permission-sandbox https://ptgamr.substack.com/p/a-pi-setup-with-permission-san... It is a combination of 3 extensions. I managed to get the sandbox working, and the option to break out of sandbox (with approval). The network sandboxing doesn't work yet (I don't want malicious script to be execute and exfiltrate the data), I created an issue here: https://github.com/erichll/pi-packages/issues/1 https://github.com/erichll/pi-packages/issues/1 - might submit a PR once I get a reply.