{"id":"3792387c-0941-4153-be2b-12fb9d2c9f0f","task":"Inject generated configuration data, secrets, or a stub /etc/passwd into a bubblewrap (bwrap) sandbox directly from file descriptors, without writing temporary files to the host filesystem, using --file, --bind-data, --ro-bind-data, and --args.","domain":"github.com/containers/bubblewrap","steps":["Write generated config data into the sandbox from a shell process substitution: `bwrap --file 10 /etc/myapp.conf 10< <(generate-config) --ro-bind /usr /usr --proc /proc --dev /dev COMMAND`. Per bwrap.xml, `--file FD DEST` 'Copy from the file descriptor FD to DEST,' default mode 0666 unless a preceding `--perms` overrides it.","Set restrictive permissions on an injected secret file: `--perms 0600 --ro-bind-data 11 /run/secrets/token 11< <(cat \"$SECRET\")`. `--perms` 'does nothing on its own' and applies only 'to the next operation' (bwrap.xml); `--ro-bind-data` bind-mounts the fd's data read-only, default mode 0600.","Reproduce the official demo's identity-stub technique: `--file 11 /etc/passwd 11< <(getent passwd $UID 65534) --file 12 /etc/group 12< <(getent group $(id -g) 65534)` (source: https://raw.githubusercontent.com/containers/bubblewrap/main/demos/bubblewrap-shell.sh).","For writable injected data (bind-mounted rather than copied to a plain file), use `--bind-data FD DEST`, default mode 0600 — bwrap.xml notes 'this is not the same as --file,' which defaults to mode 0666.","Pass a large or dynamically built argument list via fd instead of argv (avoids argv length limits and keeps secrets out of `ps`): `bwrap --args 9 --ro-bind /usr /usr COMMAND 9< <(generate-nul-separated-args)`. bwrap.xml: `--args FD` 'Parse nul-separated arguments from the given file descriptor.'"],"gotchas":["`--file` (default 0666) and `--bind-data`/`--ro-bind-data` (default 0600) have different default permissions — bwrap.xml explicitly warns 'this is not the same as' the other option for exactly this reason.","`--perms OCTAL` must immediately precede the single operation it modifies; it does not carry over to subsequent `--file`/`--tmpfs`/etc. invocations (bwrap.xml: 'Subsequent operations are not affected').","`--size BYTES` only affects an immediately following `--tmpfs`, not `--file`/`--bind-data` sizing.","`--args FD` expects nul-separated arguments, not newline- or space-separated ones; malformed separators will misparse flags and values."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T04:00:33.804Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T04:00:33.804Z"},"url":"https://mcp.waymark.network/r/3792387c-0941-4153-be2b-12fb9d2c9f0f"}