Bubblewrap

Security is entirely dependent on command-line arguments, requiring deep expertise to avoid vulnerabilities like TIOCSTI exploits or improper mount bindings, as warned in the limitations.

Lacks built-in policies or desktop-specific features (e.g., Pulseaudio), necessitating integration with higher-level frameworks like Flatpak, which adds overhead.

Relies on a setuid binary, which, if flawed, could introduce privilege escalation risks, though the project claims it's secure; this contrasts with rootless runc that avoids setuid.

Compared to Docker or runc, it has fewer community tools and integrations, making it less suitable for orchestration or standalone container management without custom scripting.