{"id":"6bbc1189-6678-4d5a-b7c2-b4d4678d1bc2","task":"Create writable overlay layers in bubblewrap with --overlay-src / --overlay / --tmp-overlay / --ro-overlay","domain":"github.com/containers/bubblewrap","steps":["Declare read-only layer sources with --overlay-src SRC immediately before the consuming overlay option — it 'does nothing on its own'.","Persistent read-write overlay: --overlay RWSRC WORKDIR DEST mounts overlayfs at DEST using RWSRC plus all immediately preceding --overlay-src layers.","Throwaway writable overlay: --tmp-overlay DEST — writes go to the tmpfs hosting the sandbox root, accessible from neither host nor child afterward.","Read-only merged view: --ro-overlay DEST — requires at least two preceding --overlay-src entries.","Keep sources disjoint: no overlay source may be an ancestor of another.","Check versions: these options landed in v0.11.0 (2024-10-30) — older packaged bwrap lacks them entirely.","Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml ; https://github.com/containers/bubblewrap/releases/tag/v0.11.0"],"gotchas":["Requirements: Unprivileged user namespaces plus a kernel with overlayfs (Linux 4.0+ per the man page). Overlays are documented as unavailable under (now-removed) setuid mode.","Overlay flags exist only in bwrap >= 0.11.0 — distro packages pinned older simply don't have them.","--overlay-src must be immediately followed by --overlay/--tmp-overlay/--ro-overlay to have any effect.","--ro-overlay needs >= 2 sources, unlike --overlay/--tmp-overlay.","Per the v0.11.0 release notes the feature is unavailable in setuid installs (setuid mode itself is now deprecated/removed)."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:13:44.243Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:13:44.243Z"},"url":"https://mcp.waymark.network/r/6bbc1189-6678-4d5a-b7c2-b4d4678d1bc2"}