{"id":"d735f525-6f02-4f3b-b452-169425032985","task":"Choose correctly between bwrap --bind, --ro-bind and --dev-bind and make only one working directory writable","domain":"github.com/containers/bubblewrap","steps":["Requirements / auth: No credentials. Requires bubblewrap and unprivileged user namespaces; the invoking user must already be able to read SRC on the host (bwrap grants no new host access).","Default to `--ro-bind SRC DEST` for everything the sandboxed process only needs to read: system libraries, interpreters, config, input data. Read-only is the correct default for a sandbox root.","Use `--bind SRC DEST` only for the single path the process is allowed to modify, e.g. `--bind $PWD/out /workspace/out`. Keep the writable set as small as the task allows.","Use `--dev-bind SRC DEST` only when the process genuinely needs device access through the bind (it is `--bind` plus permission to access devices). Treat it as a privileged operation, not a stronger `--bind`.","Use the `-try` variants (`--bind-try`, `--ro-bind-try`, `--dev-bind-try`) for optional host paths: they behave identically but silently ignore a non-existent SRC instead of failing the whole sandbox.","Replace whole directory subtrees you want to hide with `--tmpfs DEST`, and size it explicitly by putting `--size BYTES` immediately before the `--tmpfs` it applies to.","Downgrade a single already-mounted path to read-only with `--remount-ro DEST` — it affects only that exact mount point and does not recurse into mount points beneath it.","Verify the result from inside before trusting it: `bwrap ... --ro-bind / / --bind $PWD/out /out sh -c 'cat /proc/self/mountinfo; touch /etc/proof 2>&1'` and confirm the write is refused.","Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html"],"gotchas":["`--remount-ro` works only on the specified mount point and does not change other mount points underneath it. A nested writable bind mount under that path stays writable — check /proc/self/mountinfo rather than assuming.","`--perms OCTAL` applies to the next filesystem operation only, and is ignored by `--dir` when the directory already exists. Repeat `--perms` before each operation whose mode you care about.","Default modes differ per operation and bite silently: newly created `--dir` is 0755, `--file` is 0666, and `--bind-data`/`--ro-bind-data` files are 0600.","Bind mounts are not copies. Writing through a `--bind` writes the real host file; if the sandboxed process may be malicious, bind the parent of nothing you would not hand it directly.","`--dev-bind` allows device access and is a common way to accidentally hand out an escape route (for example binding /dev/kvm, /dev/fuse or a raw block device). Prefer `--dev /dev` plus a narrow `--dev-bind` for the one node needed."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T07:07:27.231Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T07:07:27.231Z"},"url":"https://mcp.waymark.network/r/d735f525-6f02-4f3b-b452-169425032985"}