github.com/containers/bubblewrap

Choose the right bubblewrap privilege model: unprivileged user namespaces vs legacy setuid installs

Build a minimal-rootfs shell sandbox with bubblewrap based on the official demo script

Inject files or data into a bubblewrap sandbox via file descriptors (--file, --bind-data, --ro-bind-data, --perms)

Create writable overlay layers in bubblewrap with --overlay-src / --overlay / --tmp-overlay / --ro-overlay

Prevent terminal injection from a bubblewrap sandbox: --new-session and the TIOCSTI gotcha

Apply a seccomp BPF filter to a bubblewrap sandbox via --seccomp FD

Ensure a bubblewrap sandbox dies with its parent and monitor it via --json-status-fd / --info-fd

Give a bubblewrap sandbox a fresh PID namespace with proper /proc and /dev

Run a bubblewrap-sandboxed process as an unprivileged mapped user with --unshare-user and --uid/--gid

Block all network access in a bubblewrap sandbox with --unshare-net

Sandbox an untrusted binary with bubblewrap: read-only system dirs and a private /tmp

Audit whether a bubblewrap install is affected by the deprecated setuid mode and migrate off it

Sandbox an AI-agent-generated Python or Node script with bwrap so it can only write to its own workspace and has no network

Prevent a bwrap sandbox from injecting commands into the controlling terminal (--new-session and the TIOCSTI problem)

Use bwrap overlay mounts (--overlay-src, --overlay, --tmp-overlay, --ro-overlay) to give a sandbox a throwaway writable view of a read-only tree

Supervise a bwrap sandbox programmatically using --info-fd, --json-status-fd, --sync-fd and --lock-file

Supervise a bwrap sandbox programmatically using --info-fd, --json-status-fd, --sync-fd and --lock-file

Apply a compiled seccomp-BPF syscall filter to a bwrap sandbox with --seccomp and --add-seccomp-fd

Drop Linux capabilities in a bwrap sandbox with --cap-drop and --cap-add

Sanitize the environment passed into a bwrap sandbox with --clearenv, --setenv and --unsetenv

Control user-namespace identity in a bwrap sandbox and prevent nested user namespaces (--unshare-user, --uid/--gid, --userns, --disable-userns)

Make bwrap sandbox processes reliably die with their parent and reap zombies correctly (--unshare-pid, --die-with-parent, --as-pid-1)

Cut off all network access for a bwrap sandbox, and selectively re-enable it for one invocation

Choose correctly between bwrap --bind, --ro-bind and --dev-bind and make only one working directory writable

Run an untrusted binary in a minimal bubblewrap (bwrap) sandbox with a read-only /usr and no host filesystem access

Protect a bubblewrap (bwrap) sandbox against the TIOCSTI terminal-injection escape (CVE-2017-5226) by detaching it from the controlling terminal with --new-session, and understand the interactivity tradeoff involved.

Monitor and synchronize with a running bubblewrap (bwrap) sandbox from an external supervisor process, using --info-fd, --json-status-fd, --lock-file, and --sync-fd, including reading the child's exit code.

Add or drop Linux capabilities for a bubblewrap (bwrap) sandbox with --cap-add and --cap-drop, understanding this only has an effect when bwrap itself is invoked with elevated privilege.

Control the UID, GID, and hostname a bubblewrap (bwrap) sandbox presents to an untrusted process, and block further nested user-namespace creation, using --unshare-user, --uid, --gid, --hostname/--unshare-uts, and --disable-userns.

Inject generated configuration data, secrets, or a stub /etc/passwd into a bubblewrap (bwrap) sandbox directly from file descriptors, without writing temporary files to the host filesystem, using --file, --bind-data, --ro-bind-data, and --args.

Sanitize the environment variables seen by a process inside a bubblewrap (bwrap) sandbox using --clearenv, --setenv, and --unsetenv, and set a custom argv[0] with --argv0.

Control a bubblewrap (bwrap) sandbox's process lifecycle so an untrusted child is killed when its parent dies, zombies are reaped correctly, and PID 1 semantics inside the sandbox are explicit.

Give a bubblewrap (bwrap) sandbox a writable overlay filesystem so an untrusted process can write to what looks like a full directory tree without touching host files, using --overlay, --tmp-overlay, or --ro-overlay.

Build a minimal, read-only root filesystem for a bubblewrap (bwrap) sandbox by bind-mounting the host's /usr read-only, symlinking the standard bin/lib paths, and adding one writable bind-mounted workdir.

Give an untrusted binary its own private /tmp, /dev, and /proc inside a bubblewrap (bwrap) sandbox so it cannot see or tamper with the host's temp files, devices, or process table.

Harden a bubblewrap sandbox with seccomp syscall filtering and network isolation for untrusted code

Sandbox an untrusted binary with bubblewrap (bwrap) using user namespaces, no root required