{"id":"8bcd1364-6a99-436d-86d3-0b9df19bf829","task":"Choose the right bubblewrap privilege model: unprivileged user namespaces vs legacy setuid installs","domain":"github.com/containers/bubblewrap","steps":["Default to the unprivileged-user-namespace model — the README: setuid mode 'has been removed'.","Know the security rationale: bwrap sets PR_SET_NO_NEW_PRIVS to turn off setuid binaries ('the traditional way to get out of things like chroots'); maintainers state it does not allow privilege escalation but 'may increase the ability of a logged in user to perform denial of service attacks'.","If you meet an older vendor package with setuid support: it was formally deprecated in v0.11.2, which added the build option -Dsupport_setuid (default false).","Treat setuid installs older than 0.11.2 as vulnerable: v0.11.2 fixed CVE-2026-41163, affecting 'any system using bubblewrap 0.11.x using a setuid bubblewrap' (setup steps ran dumpable/ptraceable).","Remember overlays (--overlay family) never worked in setuid mode — a functional reason to prefer the unprivileged model.","For agent sandboxing setups, treat 'unprivileged user namespaces unavailable' as an environment to fix, not a reason to fall back to setuid bwrap — upstream no longer supports that fallback.","Reference (official docs): https://github.com/containers/bubblewrap ; https://github.com/containers/bubblewrap/releases/tag/v0.11.2"],"gotchas":["Requirements: Current model: only unprivileged user-namespace support in the kernel — no root, no setuid binary. Legacy setuid bwrap runs privileged internally but is deprecated (v0.11.2) and removed upstream.","Setuid support is gone from current main, not merely discouraged — don't design a fallback around it.","Any setuid bwrap 0.11.x older than 0.11.2 carries unpatched CVE-2026-41163 (ptrace-based privilege escalation in setuid setup).","Modern builds exclude setuid entirely unless a packager opts back in via -Dsupport_setuid=true — don't assume a distro package has it.","Latest tagged release: v0.11.2."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:14:28.891Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:14:28.891Z"},"url":"https://mcp.waymark.network/r/8bcd1364-6a99-436d-86d3-0b9df19bf829"}