ducoterra
8ee535f6ae
The image ships pi with no provider and no preferences, so a sandboxed run
meant configuring the model twice. ai-sandbox now reads the host
~/.pi/agent/{models,settings}.json and rewrites them instead of copying them:
every provider apiKey becomes "$AI_API_TOKEN" (pi resolves an env reference
itself, so no value is written to disk), '!command' header values are dropped
rather than executed, settings that point into $HOME are dropped because that
path is not mounted, and auth.json / models-store.json / sessions / extensions
are never read.
The rewritten pair is seeded into /home/sandbox/.pi/agent at container start,
owned by uid 1000 and mode 600, and is treated as managed: a host change is
re-seeded, an edit made inside the sandbox is kept and reported, a deletion
takes the host version again.
The token follows the existing environment rules -- one variable, passed by
name through the 0600 env file, announced when auto-passed. A bridged run
whose token variable is unset or empty is refused instead of starting a pi
that cannot reach its model, and the bridge never widens the allowlist: it
warns with the exact --allow to add.
Docs and examples now use a self-hosted gateway (https://aipi.reeseapps.com)
instead of vendor API endpoints, since that is the only thing this tool is
used against. 391 assertions pass (make lint, ./tests/run.sh --e2e).
LLM-Generated: true
24 lines
994 B
Plaintext
24 lines
994 B
Plaintext
# Egress allowlist -- copy to ~/.config/ai-sandbox/allow (user-wide) or to
|
|
# ./.ai-sandbox/allow in a repository (checked in, so the policy is reviewable).
|
|
#
|
|
# One entry per line. '#' starts a comment. Blank lines are ignored.
|
|
# In --net allow mode at least one entry is required; an empty list is an error.
|
|
#
|
|
# domain matched by the gate, including subdomains, at CONNECT time
|
|
# domain:port same, and a direct netfilter rule for that port
|
|
# 10.0.0.5:5432 pinned host and port (databases, internal services)
|
|
# 10.20.0.0/24 pinned subnet (default ports 80,443 unless :port given)
|
|
# [fd00::5]:8443 pinned ipv6
|
|
|
|
aipi.reeseapps.com # your model gateway
|
|
registry.npmjs.org
|
|
|
|
# typical additions, by kind:
|
|
# another gateway or a LAN inference host:
|
|
# gateway.internal:8443
|
|
# github.com # git push, if you also mount ~/.ssh
|
|
# pypi.org
|
|
# files.pythonhosted.org
|
|
# index.crates.io
|
|
# proxy.golang.org
|