# pi: am I sandboxed?

> Source: <https://perrotta.dev/2026/08/pi-am-i-sandboxed/>
> Published: 2026-08-14 22:56:29+00:00

♠ **Problem statement**: asking a coding agent whether it runs in a sandbox
returns a confident answer derived from its system prompt, not from the machine
it is actually running on.

I asked [Pi](https://github.com/earendil-works/pi-mono) exactly that. The reply
was assured:

No — pi itself doesn’t sandbox tool execution. When I run

`bash`

,`edit`

, or`write`

, they execute directly on your machine with your user’s permissions, in the current working directory (`/Users/thiago.perrotta/.pi`

). […] But there’s no OS-level sandbox (no container, no seccomp, no filesystem jail).

It’s plausible, well-formatted, and…**wrong**!. One typo-ridden command was
enough to break the illusion:

```
% ls ~/worksppace
ls: cannot access '/home/hostuser/worksppace': No such file or directory
```

`~`

is not `/Users/thiago.perrotta`

. The follow-up probe:

```
% pwd; uname -a; whoami; cat /etc/os-release
/Users/thiago.perrotta/.pi
Linux lima-rancher-desktop 6.18.37-0-virt #1-Alpine SMP PREEMPT_DYNAMIC 2026-06-29 10:52:25 aarch64 GNU/Linux
hostuser
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
```

A macOS-shaped `pwd`

inside an aarch64 Debian container, on an Alpine
[Lima](https://lima-vm.io/) VM, under Rancher Desktop. *Containerception*.

And the giveaway at the filesystem root:

```
% ls -la / | head -5
total 68
drwxr-xr-x   1 root root 4096 Aug 15 00:54 .
drwxr-xr-x   1 root root 4096 Aug 15 00:54 ..
-rwxr-xr-x   1 root root    0 Aug 15 00:54 .dockerenv
drwxr-xr-x   3 root root 4096 Aug 15 00:54 Users
```

`/.dockerenv`

, plus a `/Users`

bind mount recreating just enough of the host
path for the system prompt’s `cwd`

to resolve.

The model was not lying; it had no way to know. Its self-description comes from
tokens someone else wrote, while the ground truth sits one `uname`

away. The
useful lesson is that agent introspection is a documentation lookup, not a
measurement — for anything security-relevant, make it run the command.

The sandbox was [cco](https://perrotta.dev/2026/02/cco-claude-condom-sandbox/).

🤖 *Drafted with *

`/bloggify`

.— § —

Reply via [email](mailto:serendipity@perrotta.dev?subject=Reply to: pi: am I sandboxed?)