# pisol
Run commands in a Landrun sandbox. Run `pisol` with no command to manage the
current project's isolation settings.
`pisol` reads trusted Bash from `.isolate` in the current directory. It denies
outbound TCP by default.
## Requirements
You need:
- Bash
- [Landrun](https://github.com/Zouuup/landrun)
- Chez Scheme 10.4 or later
- Make
## Start
Build and run the editor:
```sh
make tui
```
Run a command in the current project's sandbox:
```sh
pisol your-command --with arguments
```
Use `pisol -- COMMAND` when the command name is also a pisol option.
The command receives your environment and these variables:
- `PROMPT_ENV_INDICATOR=isolated`
- `ISOLATE_ENV`, set to the resolved project directory
If `ISOLATE_ENV` is already set, pisol warns you and runs the command directly.
It does not create a nested Landlock domain.
## Use the editor
The editor accepts these commands:
```text
a add a writable directory
r remove a writable directory
p PORT allow outbound TCP to PORT
d remove an outbound TCP port
c show configuration files
? show help
x save and exit
```
When you add a directory, the input starts at your home directory. Press Tab to
complete a path. Press Tab twice to list matches. Press Enter to add the path.
You cannot add the project's writable tree again.
## Configuration
`.isolate` is trusted Bash code. Only use configuration files you trust.
A generated file looks like this:
```bash
args+=(
--rwx '/home/example/shared work'
--connect-tcp 443
)
```
A global init file at `~/.config/pisol/init` runs before the local `.isolate`
file. Use it for shared grants. Set `PISOL_INIT_CONFIG` to use another path.
The source tree includes an example init file at `config/pisol/init`. Copy it
to `~/.config/pisol/init` and change it for your needs. Remove
`--unrestricted-network` to deny outbound TCP by default.
pisol evaluates custom `.isolate` files and manages their `--rwx` and
`--connect-tcp` arguments. Saving replaces custom code with a static argument
list. This removes comments and dynamic logic.
The project tree is readable, writable and executable. Temporary storage is
writable. System configuration, shared data and standard runtime paths are
read-only. pisol grants the standard null, zero, random and terminal devices.
It adds a Wayland socket when `WAYLAND_DISPLAY` and `XDG_RUNTIME_DIR` are set.
Set `NO_COLOR=1` to disable colour. Set `ISOLATE_EXTRA_CONFIG` to use a local
configuration file other than `CURRENT_DIRECTORY/.isolate`.
## Build and install
```sh
make build
make test
make install
make copy-config
```
`make install` uses `/usr/local` by default. Use `sudo make install` only when
your chosen destination needs it.
Set `PREFIX`, `DESTDIR`, `BINDIR`, `LIBEXECDIR`, `MANDIR` or `SCHEME` to change
the build or installation paths.
