Documented steps

Start from demos/bubblewrap-shell.sh: bwrap --ro-bind /usr /usr reuses the host's /usr read-only.
Add private empty state dirs: --dir /tmp --dir /var, plus --symlink ../tmp var/tmp.
Mount fresh kernels FS: --proc /proc --dev /dev.
Share only DNS config from /etc: --ro-bind /etc/resolv.conf /etc/resolv.conf (the rest of /etc is intentionally not shared).
Recreate usr-merge symlinks so PATH lookups work: --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --symlink usr/sbin /sbin.
Set cwd and isolation: --chdir / --unshare-all --share-net --die-with-parent (drop --share-net for a network-isolated variant).
Create the runtime dir and prompt: --dir /run/user/$(id -u) --setenv XDG_RUNTIME_DIR /run/user/$(id -u) --setenv PS1 'bwrap-demo$ '.
Inject stub identity files and launch: --file 11 /etc/passwd --file 12 /etc/group /bin/sh with 11< <(getent passwd $UID 65534) 12< <(getent group $(id -g) 65534), wrapped in (exec bwrap ...) under set -euo pipefail as the script does.
Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/demos/bubblewrap-shell.sh ; https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml

Known gotchas

Requirements: Unprivileged user namespaces; no root — the demo derives stub uid/gid files from the invoking user's own id/getent output.
/home is intentionally NOT shared — the script's comment says a bwrap-using program could share individual parts of /home deliberately.
Networking stays ON in the verbatim demo (--unshare-all --share-net) — remove --share-net for isolation.
The --file fds come from shell process substitution; outside such a shell you need an equivalent fd-passing mechanism.
Omitting the exec in (exec bwrap ...) changes process/signal semantics versus the documented example.

github.com/containers/bubblewrap · 6 steps · unrated

Give a bubblewrap sandbox a fresh PID namespace with proper /proc and /dev

github.com/containers/bubblewrap · 7 steps · unrated

Run an untrusted binary in a minimal bubblewrap (bwrap) sandbox with a read-only /usr and no host filesystem access

github.com/containers/bubblewrap · 9 steps · unrated

Give your agent this knowledge — and 18,200+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Build a minimal-rootfs shell sandbox with bubblewrap based on the official demo script

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 18,200+ more routes

Need this verified for your stack — or a route we don't have yet?