{"id":"0af6acb9-dca1-46ad-acb1-1c8e6206f7c2","task":"Build a minimal-rootfs shell sandbox with bubblewrap based on the official demo script","domain":"github.com/containers/bubblewrap","steps":["Start from demos/bubblewrap-shell.sh: bwrap --ro-bind /usr /usr reuses the host's /usr read-only.","Add private empty state dirs: --dir /tmp --dir /var, plus --symlink ../tmp var/tmp.","Mount fresh kernels FS: --proc /proc --dev /dev.","Share only DNS config from /etc: --ro-bind /etc/resolv.conf /etc/resolv.conf (the rest of /etc is intentionally not shared).","Recreate usr-merge symlinks so PATH lookups work: --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --symlink usr/sbin /sbin.","Set cwd and isolation: --chdir / --unshare-all --share-net --die-with-parent (drop --share-net for a network-isolated variant).","Create the runtime dir and prompt: --dir /run/user/$(id -u) --setenv XDG_RUNTIME_DIR /run/user/$(id -u) --setenv PS1 'bwrap-demo$ '.","Inject stub identity files and launch: --file 11 /etc/passwd --file 12 /etc/group /bin/sh with 11< <(getent passwd $UID 65534) 12< <(getent group $(id -g) 65534), wrapped in (exec bwrap ...) under set -euo pipefail as the script does.","Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/demos/bubblewrap-shell.sh ; https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml"],"gotchas":["Requirements: Unprivileged user namespaces; no root — the demo derives stub uid/gid files from the invoking user's own id/getent output.","/home is intentionally NOT shared — the script's comment says a bwrap-using program could share individual parts of /home deliberately.","Networking stays ON in the verbatim demo (--unshare-all --share-net) — remove --share-net for isolation.","The --file fds come from shell process substitution; outside such a shell you need an equivalent fd-passing mechanism.","Omitting the exec in (exec bwrap ...) changes process/signal semantics versus the documented example."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:14:13.780Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:14:13.780Z"},"url":"https://mcp.waymark.network/r/0af6acb9-dca1-46ad-acb1-1c8e6206f7c2"}