What files, environment, processes, network destinations, and MCP connectivity does a real Pi RPC session require inside an OCI sandbox? Determine the minimum writable Pi state, credential projection, project/workspace mounts, approved egress, local MCP routing, and image contents needed for the proof of concept without mounting the daemon user home wholesale.
Part of #1
## Question
What files, environment, processes, network destinations, and MCP connectivity does a real Pi RPC session require inside an OCI sandbox? Determine the minimum writable Pi state, credential projection, project/workspace mounts, approved egress, local MCP routing, and image contents needed for the proof of concept without mounting the daemon user home wholesale.
The minimum Pi sandbox contract uses a pinned runtime image and narrowly projected state rather than the daemon user's home.
Bake pinned Pi, Node, the MCP adapter, CA roots, bash, git, rg, and fd into the image; set PI_OFFLINE=1.
Mount the exact persisted agent cwd read-write at the same absolute path, plus only required linked-worktree Git metadata and explicitly approved external paths.
Persist dedicated Pi session storage and minimal agent state. Inject one provider credential; coordinate writable auth.json only when OAuth refresh requires it.
Mount the generated Paseo extension and MCP config read-only and privately for one process.
Do not mount HOME, PASEO_HOME, SSH/cloud directories, ambient package trees, or general runtime sockets.
Current loopback MCP URLs cannot cross the sandbox network namespace. Provide a private route or path-limited proxy to the agent MCP endpoint.
Derive deny-default egress from the selected model, credential type, DNS resolver, and explicitly enabled MCP servers; avoid runtime package/helper downloads.
Run catalog and MCP-adapter probes under the same sandbox contract as real sessions.
Research asset: Pi sandbox requirements
Branch: research/pi-sandbox-requirements
Commit: 0c6ae449ea9b71af249ec7800077667eb570321f
## Resolution
The minimum Pi sandbox contract uses a pinned runtime image and narrowly projected state rather than the daemon user's home.
- Bake pinned Pi, Node, the MCP adapter, CA roots, bash, git, `rg`, and `fd` into the image; set `PI_OFFLINE=1`.
- Mount the exact persisted agent cwd read-write at the same absolute path, plus only required linked-worktree Git metadata and explicitly approved external paths.
- Persist dedicated Pi session storage and minimal agent state. Inject one provider credential; coordinate writable `auth.json` only when OAuth refresh requires it.
- Mount the generated Paseo extension and MCP config read-only and privately for one process.
- Do not mount `HOME`, `PASEO_HOME`, SSH/cloud directories, ambient package trees, or general runtime sockets.
- Current loopback MCP URLs cannot cross the sandbox network namespace. Provide a private route or path-limited proxy to the agent MCP endpoint.
- Derive deny-default egress from the selected model, credential type, DNS resolver, and explicitly enabled MCP servers; avoid runtime package/helper downloads.
- Run catalog and MCP-adapter probes under the same sandbox contract as real sessions.
Research asset: [Pi sandbox requirements](https://git.jb.codes/jb/paseo/src/branch/research/pi-sandbox-requirements/goals/research/pi-sandbox-requirements.md)
Branch: `research/pi-sandbox-requirements`
Commit: `0c6ae449ea9b71af249ec7800077667eb570321f`
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #1
Question
What files, environment, processes, network destinations, and MCP connectivity does a real Pi RPC session require inside an OCI sandbox? Determine the minimum writable Pi state, credential projection, project/workspace mounts, approved egress, local MCP routing, and image contents needed for the proof of concept without mounting the daemon user home wholesale.
Resolution
The minimum Pi sandbox contract uses a pinned runtime image and narrowly projected state rather than the daemon user's home.
rg, andfdinto the image; setPI_OFFLINE=1.auth.jsononly when OAuth refresh requires it.HOME,PASEO_HOME, SSH/cloud directories, ambient package trees, or general runtime sockets.Research asset: Pi sandbox requirements
Branch:
research/pi-sandbox-requirementsCommit:
0c6ae449ea9b71af249ec7800077667eb570321f