# Bubblewrap (bwrap) 109 Hacker News commenters recommended Bubblewrap (bwrap) and 32 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months. It meets the Hacker Approved badge rule. **Verdict:** A lightweight, flexible Linux sandbox for confining AI coding agents and untrusted programs to the files they need, though it shares the host kernel and complex setups get fiddly. ## Why people recommend it - Sandboxes AI coding agents (9 comments): "This is a lot less annoying than a container for stuff where I legitimately want to be able to point agents at random stuff" ([source](https://news.ycombinator.com/item?id=48394220)) "the pattern using bubblewrap in front of Claude can be exactly duplicated and applied to other coding agents" ([source](https://news.ycombinator.com/item?id=46628144)) "Typically I just want to isolate the agent disallowing it from accessing other parts of the filesystem." ([source](https://news.ycombinator.com/item?id=48851740)) - Fine-grained, flexible filesystem control (8 comments): "bubblewrap is a lot more flexible: You can freely piece together the sandboxed filesystem environment from existing directories, tmpfs, files or data provided via a file descriptor." ([source](https://news.ycombinator.com/item?id=46632974)) "it's pretty great since you don't have to trust the harness and can quite easily customize the sandbox to your needs" ([source](https://news.ycombinator.com/item?id=50062945)) "unsharing everything and then adding back everything your agent needs saves the trouble of updating a docker image" ([source](https://news.ycombinator.com/item?id=48888864)) - Lighter than containers or VMs (5 comments): "This is a lot less annoying than a container for stuff where I legitimately want to be able to point agents at random stuff" ([source](https://news.ycombinator.com/item?id=48394220)) "bwrap is much more honest in that regard: it’s just a syscall with no background processes and zero required privileges" ([source](https://news.ycombinator.com/item?id=46887187)) "Bubblewrap is a good tech to check out and likely a better tool if you're looking for a simpler option" ([source](https://news.ycombinator.com/item?id=49972968)) - Isolates untrusted apps like Steam (4 comments): "Let's me run harnesses and compilers and even headless Firefox in sandboxes without worrying about damage to random parts of my system." ([source](https://news.ycombinator.com/item?id=49780624)) "for GUI apps such as Steam and games where running a separate graphical session isn't practical, you can use bubblewrap." ([source](https://news.ycombinator.com/item?id=49502931)) "I do this for things like Steam, games, or other "blackbox" closed source programs that cannot be reasonably trusted." ([source](https://news.ycombinator.com/item?id=48894687)) ## What people warn about - Shared kernel limits security (6 comments): "You can use this to be (much) more secure than otherwise, but it's not a security-oriented design" ([source](https://news.ycombinator.com/item?id=46645740)) "Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root." ([source](https://news.ycombinator.com/item?id=49308460)) "I even compiled Bubblewrap too so I can jail some of these, and yet I don't trust them 100%" ([source](https://news.ycombinator.com/item?id=50196606)) - Cumbersome for complex setups (5 comments): "bwrap needs additive mode; take everything (aside some basics like stdin/out/err acces) by default, then add permissions." ([source](https://news.ycombinator.com/item?id=49976187)) "whereas with bubblewrap you have to manually bootstrap the availability of each individual dev tool" ([source](https://news.ycombinator.com/item?id=48779441)) "your Go build fails because you haven't put the local cache dir in the "allowed directories"" ([source](https://news.ycombinator.com/item?id=49243410)) - Linux-only, needs user namespaces (2 comments): "it either requires root or it requires unprivileged user namespaces and it's not x-plat" ([source](https://news.ycombinator.com/item?id=49376080)) "I like the bubblewrap approach, it just happens to be Linux-only unfortunately." ([source](https://news.ycombinator.com/item?id=46692651)) - Problems alongside Docker (2 comments): "This is what I currently do, but my software uses docker and docker mounts act as a bypass for the file system restrictions" ([source](https://news.ycombinator.com/item?id=49242369)) "neither the bundled bubblewrap nor the Ubuntu 24.04 bubblewrap works properly under Docker with the default options" ([source](https://news.ycombinator.com/item?id=49287249)) ## Alternatives hackers recommend - [Agent Safehouse](https://hackerapproved.com/p/agent-safehouse.md): 43 recommend - [nono](https://hackerapproved.com/p/nono.md): 34 recommend - [Firejail](https://hackerapproved.com/p/firejail.md): 30 recommend - [sandbox-exec](https://hackerapproved.com/p/sandbox-exec.md): 25 recommend - [Bubblewrap (bwrap)](https://hackerapproved.com/p/bwrap.md): 11 recommend ## Cite as Hacker Approved, "Bubblewrap (bwrap)", https://hackerapproved.com/p/bubblewrap/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).