Skip to content
All tags

#openshell

2 posts
techprojectpi-mono Deep Dive

pi-mono Deep Dive 15: Containerization, Sandbox, Permission Model — Gondolin, Docker, OpenShell, Security Boundaries

Why Pi has no built-in permission system, Gondolin Extension (micro-VM), Docker mode, OpenShell policy-controlled sandbox, permission model philosophy, three containerization patterns, security boundary comparison, micro-VM vs container vs process isolation.

#pi#coding-agent#ai-tools#cli#open-source#typescript#containerization#sandbox#permission-model#gondolin#docker#openshell#security
aiguideReading the OpenClaw Docs

OpenClaw Sandboxing: Four Backends, Three Independent Switches, and Thinking You're Sandboxed When You Aren't

Sandboxing is governed by three independent settings: mode (when it applies), scope (how many containers), and backend (where it runs). The most common failure is an expectation gap — `tools.exec.host` now defaults to auto, so 'unset means sandboxed' is no longer true, and the security audit has a check specifically for it.

#openclaw#sandbox#docker#podman#ssh#openshell#security#tool-policy