{"id":"b2c86988-ebfd-4976-bbae-fbee241db0e9","task":"Give a bubblewrap (bwrap) sandbox a writable overlay filesystem so an untrusted process can write to what looks like a full directory tree without touching host files, using --overlay, --tmp-overlay, or --ro-overlay.","domain":"github.com/containers/bubblewrap","steps":["Ephemeral, discardable overlay whose writes vanish on exit: `bwrap --overlay-src /usr --tmp-overlay /usr --proc /proc --dev /dev bash`. Per bwrap.xml, with `--tmp-overlay`, 'all writes will go to the tmpfs that hosts the sandbox root... Writes will therefore not be persisted across multiple runs.'","Persistent overlay backed by a real writable directory and workdir: `mkdir -p /var/lib/myapp/upper /var/lib/myapp/work && bwrap --overlay-src /usr --overlay /var/lib/myapp/upper /var/lib/myapp/work /usr --proc /proc --dev /dev COMMAND`. bwrap.xml: WORKDIR 'must be an empty directory on the same filesystem as RWSRC'.","Read-only union of two or more sources: `bwrap --overlay-src /opt/base --overlay-src /opt/patch --ro-overlay /usr --proc /proc --dev /dev COMMAND` — `--ro-overlay` 'requires at least two --overlay-src to precede it' (bwrap.xml).","Order matters when stacking multiple `--overlay-src`: 'the first source on the command line at the bottom of the stack,' and a path present in more than one source is read from the last source specified (bwrap.xml) — list lowest-priority sources first.","Check kernel support before relying on this: `--ro-overlay`, or using more than one `--overlay-src`, 'requires a Linux kernel version of 4.0 or later' per bwrap.xml."],"gotchas":["Overlay support (`--overlay`, `--tmp-overlay`, `--ro-overlay`, `--overlay-src`) was added in bubblewrap 0.11.0 (source: NEWS.md, https://raw.githubusercontent.com/containers/bubblewrap/main/NEWS.md) — older bwrap binaries will fail with an unknown-option error.","NEWS.md states this feature 'is not available when bubblewrap is installed setuid,' so it only works in the normal unprivileged user-namespace mode.","Overlayfs forbids one `--overlay-src`/`--overlay` host directory being an ancestor of another after resolving symlinks; bwrap.xml warns the kernel may not always enforce this, in which case 'overlayfs's behavior is undefined.'","`--ro-overlay` specifically needs at least two `--overlay-src` arguments beforehand — a single source will error out."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T03:59:52.506Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T03:59:52.506Z"},"url":"https://mcp.waymark.network/r/b2c86988-ebfd-4976-bbae-fbee241db0e9"}