{"id":"f51c540b-236a-427e-b057-2bfafcc74352","task":"Give a bubblewrap sandbox a fresh PID namespace with proper /proc and /dev","domain":"github.com/containers/bubblewrap","steps":["Add --unshare-pid to create a new PID namespace.","Mount a namespace-scoped procfs with --proc /proc rather than binding the host's /proc into the sandbox.","Mount a fresh devtmpfs with --dev /dev.","Note bwrap's reaper: with a PID namespace, bwrap runs a minimal pid-1 process that reaps zombies and reports the initial application process (pid 2) exit status back to the spawner (per the man page).","If your command must itself be pid 1 (own signal/job-control handling), use --as-pid-1 to skip bwrap's reaper.","Combine with --unshare-all for fuller isolation.","Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml"],"gotchas":["Requirements: Unprivileged user namespaces; --unshare-pid creates the PID namespace without root under bwrap's model.","Without --unshare-pid, --proc still mounts a procfs but it reflects the host's process table — no PID isolation.","bwrap only acts as pid 1 'if needed (e.g. when using a PID namespace)'; use --as-pid-1 deliberately when the workload needs pid 1.","bwrap's exit code is the exit code of the initial application process — use it for supervision."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:12:04.748Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:12:04.748Z"},"url":"https://mcp.waymark.network/r/f51c540b-236a-427e-b057-2bfafcc74352"}