{"id":"f72639ee-8243-438d-9009-fd88f21e6114","task":"Ensure a bubblewrap sandbox dies with its parent and monitor it via --json-status-fd / --info-fd","domain":"github.com/containers/bubblewrap","steps":["Add --die-with-parent: kills (SIGKILL) all bwrap sandbox processes, including COMMAND, when bwrap or bwrap's parent dies (implemented via prctl PR_SET_PDEATHSIG).","Open a writable fd in the calling process and pass --info-fd FD to receive JSON information about the sandbox.","Pass --json-status-fd FD for lifecycle events: multiple JSON documents are written to the fd, one per line; after the child starts, an object with a child-pid member is written.","In the controlling process, read the status fd as a newline-delimited JSON stream (start event, later exit).","Combine --die-with-parent with --json-status-fd so the monitor both tracks the child and guarantees the sandbox cannot outlive it.","Also check bwrap's own exit code, which mirrors the initial application process's exit status.","Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml"],"gotchas":["Requirements: No privilege beyond standard unprivileged user namespaces — these are lifecycle/monitoring flags.","--json-status-fd is incremental NDJSON — read it as a stream, don't wait for one final blob.","--die-with-parent uses PR_SET_PDEATHSIG semantics: it fires when bwrap's parent dies; supervisors that reparent children change what 'parent' means.","--info-fd/--json-status-fd need an actually-open writable fd (e.g. shell fd redirection); an unopened fd number fails."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:12:19.944Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:12:19.944Z"},"url":"https://mcp.waymark.network/r/f72639ee-8243-438d-9009-fd88f21e6114"}