Docker sandbox pi-less-yolo for containing the blast radius of AI changes

[cjermain]

I built a small Docker sandbox shim for pi-coding-agent that makes using pi "less YOLO".

The problem: pi runs with full access to your filesystem by default. A misunderstood instruction or a loop going sideways can touch files outside the project you're working in.

pi-less-yolo wraps pi in a Chainguard-based container that only mounts your current working directory and the necessary pi configuration files -- nothing else on the host is reachable. It scopes the permissions to avoid privilege escalation. A mise task makes it mise run pi from any project directory.

I made sure to keep the real path the same, so per-project session tracking in pi is correctly maintained. Another useful feature is that you can customize the Dockerfile easily to include the tools you need. The Chainguard base image has low CVEs, so vulnerabilities are kept to a minimum.

While this is "less YOLO", there are still serious security gaps. Network access is unrestricted, which can allow exfiltration of files. Container escapes exist, and the mounted directory is fully writable.

https://github.com/cjermain/pi-less-yolo

Happy to take feedback in the pi-less-yolo GitHub Issues.