Host
Your machine. The pi-sandbox wrapper reads .env and the Keychain, validates the project's config and starts the session.
A coding agent inside boundaries you can read
A coding agent that runs inside a container it cannot leave, with config and memory handed in from outside. Start at the outer boundary and work inward, or jump to the part you need.
$ pi-sandbox start ~/pi/ws/private/homelab
resolve domain=private project=homelab
config global → domain → project
compose own project, own network
✓ pi container read-only, non-root
✓ kube-proxy kubeconfig stays here
✓ ssh-agent keys stay here
mount project + own memory stores
pi ready. Nothing else is reachable.
$ pi-sandbox stop ~/pi/ws/private/homelab
session project removed
$ docs
Session
One compose project per session, on its own network, removed when the session ends. Read-only image, non-root, no capabilities.
Config levels
Settings, MCP servers, instructions and per-project files, merged along the path: global, domain, host and group folders, project. The nearest level wins.
Memory
Git repositories mounted per scope. The session can write only the stores of its own path; syncing is a separate, reviewed step.
Sidecars
kube-proxy holds the kubeconfig and gives the agent a filtered API by access mode. ssh-agent holds the private keys of the project's SSH hosts.
Keeping it current
semantic-release and Renovate for both repositories, and the release notes they write.