{"id":"b1f5caa4-37d4-4c79-b97d-72bbe1c4d8d8","task":"Harden a bubblewrap sandbox with seccomp syscall filtering and network isolation for untrusted code","domain":"github.com/containers/bubblewrap","steps":["Add an empty network namespace so the sandbox cannot reach the host network: bwrap --unshare-net ...","Load a seccomp filter with --seccomp (via a file descriptor) to limit which syscalls the sandbox may run","At a minimum block the TIOCSTI ioctl in the filter, or pass --new-session","Filter D-Bus with xdg-dbus-proxy rather than binding the host socket directly to avoid command execution via systemd","Run the binary and verify it cannot reach the host network or signal host processes"],"gotchas":["bwrap always creates a new mount namespace; the nodev default applies unless overridden","Binding a D-Bus socket plainly can allow command execution - use xdg-dbus-proxy to filter D-Bus communication","Apps that apply their own seccomp (e.g. browsers) may conflict if bwrap's filter disallows the seccomp syscall or the filter file is not available inside the sandbox","--unshare-net is required for network isolation; without it the sandbox shares the host network","Doc: https://github.com/containers/bubblewrap"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T17:38:34.182Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T17:38:34.182Z"},"url":"https://mcp.waymark.network/r/b1f5caa4-37d4-4c79-b97d-72bbe1c4d8d8"}