{"id":"1c2dd8b4-6258-4e26-a471-06311da58880","task":"Give an untrusted binary its own private /tmp, /dev, and /proc inside a bubblewrap (bwrap) sandbox so it cannot see or tamper with the host's temp files, devices, or process table.","domain":"github.com/containers/bubblewrap","steps":["Create a private, size-bounded /tmp: `bwrap --unshare-pid --unshare-user --ro-bind /usr /usr --symlink usr/lib /lib --symlink usr/bin /bin --proc /proc --dev /dev --size 16777216 --tmpfs /tmp --chdir / bash -c 'echo hi > /tmp/x; mount | grep tmp'` — confirms /tmp is a fresh tmpfs bounded by --size rather than the host's real /tmp.","Mount a fresh, minimal /dev instead of exposing the host's real devices: `--dev /dev`. Per bwrap.xml (source: https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml), `--dev DEST` mounts a new devtmpfs, which differs from `--dev-bind SRC DEST`, which bind-mounts the host's actual device tree.","If one specific host device (e.g. /dev/dri for GPU access) must be exposed, bind it individually: `--dev-bind-try /dev/dri /dev/dri` (per bwrap.xml, `--dev-bind` 'allows device access' and the `-try` variant 'ignores non-existent SRC'); keep this narrowly scoped instead of bind-mounting all of /dev.","Mount a private /proc with `--proc /proc`, and combine it with `--unshare-pid` so the sandbox has its own PID namespace and the mounted /proc only exposes processes inside the sandbox.","Verify isolation end-to-end: `bwrap --unshare-pid --unshare-user --ro-bind /usr /usr --proc /proc --dev /dev --symlink usr/bin /bin ps aux` and confirm only the sandboxed process tree is visible, not host processes."],"gotchas":["`--dev DEST` creates a new, minimal devtmpfs; it is not the same as `--dev-bind /dev /dev`, which exposes the host's real device nodes (source: bwrap.xml, Filesystem related options).","`--tmpfs DEST` uses bwrap's default tmpfs size unless immediately preceded by `--size BYTES`, and defaults to mode 0755 unless immediately preceded by `--perms OCTAL` (bwrap.xml).","Without `--unshare-pid`, mounting `--proc /proc` still reflects the full host process table through procfs, defeating the isolation intent even though the mount itself is 'private'.","Any parent directories bwrap must auto-create default to mode 0755 unless a preceding `--perms` sets group/other bits to zero, per bwrap.xml's Filesystem related options preamble."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T03:59:25.104Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T03:59:25.104Z"},"url":"https://mcp.waymark.network/r/1c2dd8b4-6258-4e26-a471-06311da58880"}