Inject generated configuration data, secrets, or a stub /etc/passwd into a bubblewrap (bwrap) sandbox directly from file descriptors, without writing temporary files to the host filesystem, using --file, --bind-data, --ro-bind-data, and --args.

Documented steps

1. Write generated config data into the sandbox from a shell process substitution: `bwrap --file 10 /etc/myapp.conf 10< <(generate-config) --ro-bind /usr /usr --proc /proc --dev /dev COMMAND`. Per bwrap.xml, `--file FD DEST` 'Copy from the file descriptor FD to DEST,' default mode 0666 unless a preceding `--perms` overrides it.
2. Set restrictive permissions on an injected secret file: `--perms 0600 --ro-bind-data 11 /run/secrets/token 11< <(cat "$SECRET")`. `--perms` 'does nothing on its own' and applies only 'to the next operation' (bwrap.xml); `--ro-bind-data` bind-mounts the fd's data read-only, default mode 0600.
3. Reproduce the official demo's identity-stub technique: `--file 11 /etc/passwd 11< <(getent passwd $UID 65534) --file 12 /etc/group 12< <(getent group $(id -g) 65534)` (source: https://raw.githubusercontent.com/containers/bubblewrap/main/demos/bubblewrap-shell.sh).
4. For writable injected data (bind-mounted rather than copied to a plain file), use `--bind-data FD DEST`, default mode 0600 — bwrap.xml notes 'this is not the same as --file,' which defaults to mode 0666.
5. Pass a large or dynamically built argument list via fd instead of argv (avoids argv length limits and keeps secrets out of `ps`): `bwrap --args 9 --ro-bind /usr /usr COMMAND 9< <(generate-nul-separated-args)`. bwrap.xml: `--args FD` 'Parse nul-separated arguments from the given file descriptor.'