A low-level unprivileged sandboxing tool for Linux that creates container environments without requiring root privileges.
Bubblewrap is a low-level sandboxing tool for Linux that allows unprivileged users to create isolated container environments without requiring root privileges. It provides a subset of user namespace functionality through a setuid binary, focusing on security and minimalism while enabling frameworks like Flatpak to build higher-level sandboxing solutions.
Developers and system integrators building containerized applications or sandboxing frameworks on Linux, particularly those needing unprivileged operation on distributions without full user namespace support.
Bubblewrap offers a minimal, auditable sandboxing foundation that's safer than full user namespaces for unprivileged use, with no path whitelisting vulnerabilities and proven integration in production systems like Flatpak.
Low-level unprivileged sandboxing tool used by Flatpak and similar projects
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Runs without root access using a setuid binary, enabling sandboxing for regular users on distributions like CentOS 7 that lack full user namespace support.
Focuses on a small codebase for low-level sandboxing, making it easier to security audit compared to more complex tools like Firejail.
Uses PR_SET_NO_NEW_PRIVS to disable setuid binaries within the sandbox and avoids path whitelisting to prevent TOCTTOU attacks, as highlighted in the README.
Designed to be used by higher-level frameworks like Flatpak and libgnome-desktop, allowing them to implement custom security policies on top of it.
The level of protection is entirely determined by command-line arguments, requiring users to carefully construct sandboxes to avoid vulnerabilities like CVE-2017-5226, which the README admits.
Does not include built-in support for desktop integration features such as D-Bus or Pulseaudio filtering, necessitating additional tools like xdg-dbus-proxy, as noted in the Limitations section.
Relies on a setuid binary, which can be a security concern and limits deployment in environments that restrict such binaries to minimize attack surfaces.