Skip to content

Instantly share code, notes, and snippets.

@pqnet
pqnet / sandboxed-pi.sh
Last active April 30, 2026 07:41
A script to run a pi coding agent without write access to anything it should not have access to
#!/usr/bin/sh
# Setup/troubleshooting:
# - create the localhost/empty image with `podman build . -f <(echo FROM scratch) -t localhost/empty:latest`
# - ensure pi works locally
# - check that all dynamic libraries required by bash and nodejs are in the mounted folder (using ldd), eventually add more
# Tested on ubuntu 24.04
exec podman run --rm -it --network host \
--volume /lib64:/lib64:ro \
--volume /lib:/lib:ro \
--volume /usr:/usr:ro \
@pqnet
pqnet / Makefile
Last active August 29, 2015 14:24
test: main.o counter.o libcounter.so
$(CXX) -fPIC -o test main.o counter.o libcounter.so
main.o: main.cpp
$(CXX) -fPIC -c -o main.o main.cpp
counter.o: counter.cpp
$(CXX) -fPIC -c -o counter.o counter.cpp