>>110214005
#!/usr/bin/env bash
sandbox=~/.local/share/sandboxes/sandbox
mkdir -p $sandbox
PWD="$(realpath $PWD)"
PWDARG="--bind $PWD $PWD"
if [ "$PWD" == "$HOME" ]
then
echo PWD is HOME, not binding it
PWDARG=""
fi
bwrap \
--ro-bind /bin /bin \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /etc /etc \
--ro-bind /sbin /sbin \
--ro-bind /usr /usr \
--ro-bind /run/systemd/resolve /run/systemd/resolve \
--dev /dev \
--tmpfs /tmp \
--proc /proc \
--bind $sandbox $HOME \
$PWDARG \
--die-with-parent \
--unshare-all \
--share-net \
$@
and `alias pi="alias pi="TMPDIR=~/.cache/tmpdir sb --bind ~/.config/pi ~/.pi/agent pi"
do the alias for whatever's your harness, you could also use a tinyvm instead of bubblewrap.
anyway, it only binds PWD unless it's $HOME.
>then it is able to fuck up the install as well
nope, api won't let it touch the files.
>How else is it going to generate images on your behalf using comfyui
API / MCP, god just look these things up.
>Even in your own sandbox description it can still fuck up your install either accidentally or on purpose
no because it has no access to the files
>this has nothing to do with sandboxing
this has everything to do with sandboxing, you just lack the understanding.
>Sandboxing would not have prevented this AT. ALL
yes it would because it'd not have had access to the comfyui files, thus couldn't have fucked up the install.
anyway, i'm done arguing with your lack of understanding on the topic, learn something, learn what an api or mcp is.
