Documented steps

Requirements / auth: No credentials. Requires bubblewrap and unprivileged user namespaces on the host.
Add `--unshare-net` to create a new network namespace. The sandbox gets only a loopback interface and cannot reach the host network, the LAN, or the internet.
Prefer `--unshare-all` when you want full isolation: it already includes `--unshare-net` along with user, ipc, pid, uts and cgroup namespaces.
When one specific invocation must reach the network, append `--share-net` after `--unshare-all` — it is documented as retaining the network namespace, overriding an earlier `--unshare-all` or `--unshare-net`.
Remember that argument order matters here: put `--share-net` after the `--unshare-*` option it is meant to override, not before it.
If the networked variant needs DNS and TLS, bind the resolver and trust store in read-only: `--ro-bind /etc/resolv.conf /etc/resolv.conf --ro-bind /etc/ssl /etc/ssl`. Without them the sandbox has a network but resolves nothing.
Verify isolation empirically rather than by inspection: `bwrap --ro-bind / / --unshare-all sh -c 'ip -br addr; getent hosts example.com; echo rc=$?'` should show only lo and fail resolution.
Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html

Known gotchas

`--unshare-net` cuts network access but leaves any already-bound unix sockets usable. A bound D-Bus, Docker or ssh-agent socket is a full escape path regardless of the network namespace.
There is no way to give a `--unshare-net` sandbox a routed interface from bwrap itself: bubblewrap is a low-level tool with no NAT or veth setup. Configure networking externally and hand the sandbox a prepared namespace, or use `--share-net`.
`--share-net` shares the host network namespace outright — it is all-or-nothing, not a filtered network. If you need egress rules, run bwrap inside a network namespace you have already firewalled.
Copying /etc/resolv.conf into the sandbox with `--ro-bind` pins the host's resolver at start time. On a laptop or container whose resolv.conf is rewritten, long-lived sandboxes keep the stale copy.
`--unshare-all` uses `--unshare-user-try`, which skips the user namespace if it cannot be created. On a host with unprivileged user namespaces disabled you can silently get less isolation than you asked for — add explicit `--unshare-user` if you require it to fail loudly.

github.com/containers/bubblewrap · 8 steps · unrated

Run an untrusted binary in a minimal bubblewrap (bwrap) sandbox with a read-only /usr and no host filesystem access

github.com/containers/bubblewrap · 9 steps · unrated

Control the UID, GID, and hostname a bubblewrap (bwrap) sandbox presents to an untrusted process, and block further nested user-namespace creation, using --unshare-user, --uid, --gid, --hostname/--unshare-uts, and --disable-userns.

github.com/containers/bubblewrap · 5 steps · unrated

Give your agent this knowledge — and 18,100+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Cut off all network access for a bwrap sandbox, and selectively re-enable it for one invocation

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 18,100+ more routes

Need this verified for your stack — or a route we don't have yet?