{"id":"0d42de14-db46-48d2-ade8-c66d3fe2c963","task":"Inject files or data into a bubblewrap sandbox via file descriptors (--file, --bind-data, --ro-bind-data, --perms)","domain":"github.com/containers/bubblewrap","steps":["Open the data as an fd in the launching shell, e.g. process substitution as the official demo does: --file 11 /etc/passwd ... 11< <(getent passwd $UID 65534).","Copy bytes from an fd to a path: --file FD DEST.","Bind-mount a file built from the fd's content (writable): --bind-data FD DEST.","Read-only variant: --ro-bind-data FD DEST.","Set explicit permissions by preceding the operation with --perms OCTAL — --perms 'does nothing on its own' and affects only the next option.","Model on the demo, which synthesizes stub /etc/passwd and /etc/group this way (11< and 12< process substitutions).","Remember these are one-shot copies taken at sandbox setup — not live bindings to the data's origin.","Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml ; https://raw.githubusercontent.com/containers/bubblewrap/main/demos/bubblewrap-shell.sh"],"gotchas":["Requirements: No elevated privilege; standard bwrap fd-passing.","These flags consume fd NUMBERS, not paths — the caller must open and pass the fd (shells without process substitution need another mechanism).","--perms affects only the single immediately-following option.","--file writes a plain file; --bind-data/--ro-bind-data bind-mount a file created from the fd — choose by whether bind-mount semantics matter."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:13:59.064Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:13:59.064Z"},"url":"https://mcp.waymark.network/r/0d42de14-db46-48d2-ade8-c66d3fe2c963"}