Build1 publisher2 min readPublished
Pi runs the model's shell commands with the permissions of whoever launched it
A seven-part video walkthrough is packaging the Flask creator's Pi workflow for a general audience. The harness itself leaves isolation to the operator, and Earendil's own documentation says so plainly.
The Engineer · Build desk
What happened
- David Ondrej published a seven-part video walkthrough on September 12th built around the coding-agent workflow of Armin Ronacher, the Flask creator who works on the Pi agent harness operated by Earendil Works.
- Pi's security documentation says the agent runs with the permissions of the user who starts it and includes no built-in sandbox.
- Earendil recommends putting Pi inside a container, virtual machine, micro-VM or other controlled environment for untrusted repositories and unattended work.
- Pi originated with libGDX creator Mario Zechner, who brought it into Earendil in April 2026 and became a shareholder, with direction and merge decisions governed by Zechner, Ronacher and co-founder Colin.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Anything the developer's account can read or change, an unattended run can read or change, so a bad tool call reaches the laptop and not only the checkout.
- cost The isolation is unbudgeted work that arrives with the tutorial, and it lands on whoever owns the machines the extensions get installed on.
- decision Each developer following the videos picks the isolation model, so a fleet owner gets as many boundaries as there are installs unless one is set centrally.
- constraint Approving a project's trust settings cannot be used as the audit story, because it does not limit what the agent's shell commands do once loaded.
Pi's standard tools read files, write them, edit them and run shell commands [4]. Tools and TypeScript extensions do that as ordinary local processes, with the same reach as the account that started the session [6].
Project trust settings do a narrower job than the name suggests. They decide whether local configuration and extensions load, and they do not put a security boundary around model output or shell execution [8].
Pi also ships without native MCP support, sub-agents, plan mode, permission pop-ups, built-in to-do lists or background shell execution [9]. Five of those six are workflow features; permission pop-ups is the only one a new user would mistake for a control [19]. Ronacher describes the missing MCP support as a product choice tied to Pi's preference for user-built extensions [10]. runtimewire argues that the design has a merit in this, because Pi does not present a partial permission layer as comprehensive protection, and each team picks the isolation model that fits its infrastructure [12].
The workflow being taught is a real one. In a January 31st essay, Ronacher says he uses extensions to collect answers to the agent's questions, keep local to-do files, review changes in a separate session branch and surface the files a run touched [14]. In the same essay he says he favors conversational back-and-forth over a fixed plan mode [14]. He describes Pi sessions as trees: branch into a fresh context for a code review or a tool repair, then bring the findings back to the main session [15]. That review branch can begin from a clean context and flag details including newly introduced dependencies before a human reviews the changes [16].
Pi's site tells users to ask Pi to build commands, tools, providers, workflows or interface changes, then reload the modified harness in place [17].
Ondrej described the clips as Ronacher's "exact agentic engineering workflow" [2]. The thread points viewers at Pi's open-source repository, hosted by Earendil Works, and closes with links to PostHog and Ondrej's community [3]. runtimewire's description of the seven parts covers the workflow and those links; containment is not in it [21].
Ronacher is a credible protagonist for the packaging: he created Flask, contributed to Jinja and Pygments, spent roughly a decade at Sentry, and left in 2025 to build Earendil [18]. Copying his setup takes more than installing his preferred extensions, because a team also has to reproduce the containment and the credential controls [13].
What to watch
- Whether Earendil changes Pi's defaults to launch inside a container, or keeps isolation an operator choice.
- Whether Ondrej's series adds a containment segment, or his community publishes an install path that skips it.
- Whether the Zechner, Ronacher and Colin governance group revisits what project trust settings are allowed to load.