{"id":"19b9ea4b-8ea4-4291-9488-feab8a9eec4b","task":"Block all network access in a bubblewrap sandbox with --unshare-net","domain":"github.com/containers/bubblewrap","steps":["Add --unshare-net to place the process in a new network namespace, or use --unshare-all which already includes it.","To keep host networking while isolating other namespaces, explicitly add --share-net after --unshare-all (the official demo uses --unshare-all --share-net).","To actually block networking, simply omit --share-net — the demo's own comment: 'remove --share-net to disable networking'.","Drop DNS binds like --ro-bind /etc/resolv.conf /etc/resolv.conf if no network use is intended.","Verify isolation empirically: attempt a TCP connect inside the sandbox and confirm it fails.","Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml ; https://raw.githubusercontent.com/containers/bubblewrap/main/demos/bubblewrap-shell.sh"],"gotchas":["Requirements: Unprivileged user namespaces; creating a network namespace via --unshare-net needs no extra privilege.","--unshare-all includes network unsharing — copying the demo verbatim keeps networking ON because it pairs it with --share-net; omitting --share-net silently kills networking.","Flag position matters (sequential option processing): where --share-net appears relative to --unshare-all/--unshare-net changes the result.","The man page only documents that a new network namespace is created; don't assume more granular reachability guarantees (e.g. loopback details) from these docs."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:11:32.555Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:11:32.555Z"},"url":"https://mcp.waymark.network/r/19b9ea4b-8ea4-4291-9488-feab8a9eec4b"}