Bubblewrap Alternatives

Reviews and mentions

• Linux kernel: Heap buffer overflow in fs_context.c since version 5.1
  1 project | reddit.com/r/linux | 20 Jan 2022

  I believe a safer alternative to user namespaces is https://github.com/containers/bubblewrap.

• Hello, youki! Faster container runtime is written in Rust
  6 projects | reddit.com/r/rust | 26 Dec 2021

  What is missing in bubblewrap for you?

• Ask HN: What's the best way to secure your workstation?
  1 project | news.ycombinator.com | 28 Nov 2021

  Would you mind elaborating on what's wrong with flatpak? bubblewrap, used by flatpak for isolation, seems less readily escapable than firejail (https://github.com/containers/bubblewrap/blob/master/README....).

  (edit: changed link formatting)

• [Question] Is the Rust Compiler safe?
  5 projects | reddit.com/r/rust | 21 Nov 2021

  crosvm mentions minijail, which is a sandboxing tool that can sandbox individual processes in a machine. Other tools in that space are firejail and bubblewrap.

• Rambox Pro
  3 projects | reddit.com/r/PrivacyGuides | 22 Oct 2021

  Nevertheless, Ferdi is effectively a web browser, so it's still a good idea to run it in a sandbox (but make sure any external sandbox doesn't interfere with Chromium's internal sandbox), like Flatpak, firejail (full disclosure: I've also made some commits to firejail), or bubblewrap (out of these, bubblewrap is probably the technically most superior on recent Linux kernels, but somewhat difficult to use).

• Bubblewrap: Unprivileged Sandboxing Tool
  1 project | news.ycombinator.com | 3 Oct 2021
• Thoughts about an article talking about the insecurity of linux
  4 projects | reddit.com/r/linux | 27 Sep 2021

  If your threat model is somewhat normal a linux installation is not that bad, more so if you harden it a little. Choose a distro with selinux (or have fun setting it up yourself), use wayland, and to bubblewrap things off, isolate and restrict the more exposed applications like the browser.

• What can a beginner do to secure their system?
  6 projects | reddit.com/r/linuxquestions | 30 Aug 2021
• Linux simple security enable.
  1 project | reddit.com/r/linux | 15 Aug 2021

  If you want to have some more security, enjoy SELinux. Or bwrap. Or Tails. All have their benefits and drawbacks, but in times of ransomware and phishing, they might be more relevant.

• FreeBSD Implements Unprivileged Chroot
  3 projects | news.ycombinator.com | 22 Jul 2021

  An alternative to unshare is also bubblewrap (https://github.com/containers/bubblewrap) which also sets up a new namespace. You can build up your own new filesystem by binding existing paths into the new root and then run a process within it:

      $ mkdir -p root/bin

  3 projects | news.ycombinator.com | 22 Jul 2021

  without being root. (This requires a sysctl to be enabled for unprivileged user namespaces, which is on by default in the kernel.org tree and I think all major distro kernels have it on now. The feature has been in the upstream kernel since 2013.)

  If you want to do this at scale, a handy tool is bwrap(1) from https://github.com/containers/bubblewrap . (The README talks about how bwrap is a setuid program to prevent the need for that sysctl, but it also works great as a non-setuid program when that sysctl is enabled, and its value is it has a bunch of handy command-line flags for this sort of thing. We use it extensively at my workplace in non-setuid mode for things that don't quite need containers but need to see alternative root directories etc.)

• Flatpak – A Security Nightmare
  2 projects | news.ycombinator.com | 22 Jun 2021

  Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap

• Transition to Wayland? Native wayland apps? Any compromises?
  1 project | reddit.com/r/linuxquestions | 17 Jun 2021

  I've heard about this https://github.com/containers/bubblewrap sometime ago.

• Firefox 88 combats window.name privacy abuses – Mozilla Security Blog
  3 projects | reddit.com/r/privacytoolsIO | 19 Apr 2021

  Flatpak is simpler and more convenient (here's Firefox). You can also use its base technology, Bubblewrap, directly.

• cap-std: Capability-oriented version of the Rust standard library
  3 projects | reddit.com/r/rust | 13 Apr 2021

  You can use bubblewrap for that: