Berry Wiki

Pi Landstrip

Properties2
tagsai, sandboxing
aliasesPi Landstrip

6 min read

Pi Landstrip

Summary

Pi Landstrip is a Pi coding-agent extension that applies operating-system sandbox rules and asks for permission when the agent reaches outside those rules. It wraps Pi shell commands with Landstrip and restricts Pi’s file tools.

  • Package: pi-landstrip
  • Underlying project: landstrip/landstrip
  • Current version: 0.17.6
  • Checked: 2026-07-14

Problem

Coding agents need shell, file, and network access, but broad access can expose unrelated files and credentials. Pi Landstrip supplies deterministic operating-system limits while allowing the user to approve a specific path or domain when needed.

How It Works

  • Shell wrapping: Pi’s AI shell calls and manually entered ! and !! commands run through Landstrip.
  • File-tool checks: Pi reads and writes outside configured allow-lists are blocked.
  • Interactive grants: A dialog can reject access or allow it once, for the session, for the project, or globally.
  • Visible target: The dialog shows the exact path or domain requested.
  • Saved policy: Project grants go to .pi/sandbox.json; global grants go to ~/.pi/agent/sandbox.json.
  • Policy format: The policy follows a subset of Anthropic Sandbox Runtime JSON and can be global or project-specific.

Security Boundary

Landstrip uses native process controls rather than a container or virtual machine:

  • Linux: Landlock kernel rules plus seccomp mediation.
  • macOS: Seatbelt sandbox profiles.
  • Windows: Low-privilege AppContainer rules and a Job Object for the process tree.

The default Pi policy denies network access, limits reads mostly to the project and Git configuration, and limits writes to the project. It also denies writes to common environment and key-file patterns.

Limits of the boundary:

  • It shares the host kernel and installed tools.
  • An approved path or domain becomes accessible to the sandboxed process tree.
  • Unsupported platforms load the extension with sandboxing disabled.
  • Pi packages themselves are executable code and must be trusted.
  • Platform behavior differs, especially for wildcard file rules and fine-grained networking.

Platforms And Agents

  • Agent: Pi is the direct integration.
  • Linux: Supported; requires Linux 5.13 or later with Landlock enabled for that enforcement layer.
  • macOS: Supported through Seatbelt.
  • Windows: Supported through LPAC AppContainer, with coarser network controls.
  • OpenCode: The same repository offers a separate opencode-landstrip integration.
  • Other agents: The Landstrip command can wrap general tools, but Pi Landstrip itself is Pi-specific.

Setup

Install from Pi:

pi install npm:pi-landstrip

The package includes platform-specific native binaries. It can also be listed in Pi’s global or project settings. Use /sandbox inside Pi to inspect and change the active policy. --no-sandbox or enabled: false disables it.

Network And Credentials

  • Default: Direct network access is off.
  • Allowed domains: Connections can pass through an allow-list proxy after explicit approval.
  • Prompts: Network and filesystem requests can trigger a host notification and approval dialog.
  • Child processes: The sandbox is intended to cover commands spawned by the wrapped process, including SSH attempts.
  • Default reads: Project files, Git configuration, and /dev/null are allowed; home directories are otherwise denied.
  • Credentials: Credentials remain protected only while their paths and destinations remain outside approved policy. A user can deliberately grant access.
  • Windows caveat: Network access is broadly allow or deny; per-host or per-port controls would require elevated Windows Filtering Platform rules and are not implemented.

Strengths

  • Fast and local: Process sandboxing avoids building or booting a container or VM.
  • Deterministic enforcement: Kernel or OS rules enforce paths instead of relying on agent judgment.
  • Useful prompts: Approvals name the exact requested resource and support several lifetimes.
  • Strict default: Project-scoped reads and writes with network disabled reduce accidental exposure.
  • Cross-platform goal: Native backends cover Linux, macOS, and Windows.
  • Policy compatibility: Anthropic-style JSON lowers the cost of reusing policy ideas.

Limits

  • Weaker isolation than a VM: The agent shares the host kernel and host toolchain.
  • Fail-open platform behavior: On an unsupported platform, the extension remains loaded but sandboxing is disabled.
  • Different guarantees by OS: macOS wildcard denies are fixed at startup; newly created matching files may not be protected. Windows does not enforce wildcard write denies.
  • Windows network granularity: Only broad network capability is available.
  • Project remains writable: The agent can alter allowed project files.
  • Approval fatigue: Repeated dialogs may lead users to grant broader access than intended.
  • Young security project: No independent audit or formal verification was found.

Activity And Maturity

Checked 2026-07-14:

  • Latest release: 0.17.6, published 2026-07-14.
  • Repository created: 2026-06-01.
  • Latest checked commit: 4c9baa49aa23, dated 2026-07-14.
  • Repository history: 706 commits and 79 visible releases.
  • Interest: 36 stars and 1 fork.
  • Package use: Pi reported about 11,600 monthly and 2,341 weekly downloads.
  • Assessment: Rapidly developed and actively released, but still young for a security boundary.

Best Fit

Best for a Pi user who wants fast, project-scoped protection on a normal workstation and is willing to approve exceptional file or network access.

It is a weaker fit for hostile code, strict multi-tenant use, workloads needing root or system services, or organizations requiring VM isolation and audited controls.

Comparison

  • Versus Clawk: Pi Landstrip starts faster and reuses the host environment. Clawk provides a separate kernel and disposable Linux machine but uses more resources.
  • Versus Docker: Pi Landstrip needs no image and preserves normal host tooling. Docker provides a fuller filesystem/process environment but still shares the host kernel.
  • Versus Pi without the extension: It adds OS-enforced file and network limits plus explicit approval prompts.
  • Versus broad allow/deny tools: Its per-path and per-domain approval flow is more usable for changing development tasks.

HN Context

In the Clawk thread, a commenter suggested Landlock and Bubblewrap on Linux and linked Pi Landstrip as the lightweight alternative. Another commenter argued that ordinary agent sandboxes can still see SSH keys and use the network. The Pi Landstrip commenter replied that this extension prompts whenever the agent accesses outside the working directory or makes a network request, and that child processes such as SSH remain covered.

The exchange captures its tradeoff: lightweight controls on the developer’s existing machine, rather than a disposable machine with a separate kernel.

Unknowns

  • Audit: No independent security audit was found.
  • Failure warning: The package page does not explain how prominently users are warned when a platform is unsupported and enforcement is disabled.
  • Non-shell tools: Exact coverage of third-party Pi extensions and any direct native operations depends on how they execute; only Pi shell and file-tool behavior is explicitly documented.
  • Download accuracy: Package download counts are the Pi registry’s displayed figures, not independently verified.

Sources

Graph View