Bubblewrap (bwrap)

“I even compiled Bubblewrap too so I can jail some of these, and yet I don't trust them 100%”

“a couple of extra injected bwrap args to make my SSH keys and LLM API credentials unreadable”

“it's pretty great since you don't have to trust the harness and can quite easily customize the sandbox to your needs”

“it becomes pretty unwieldy when you start trying to do anything moderately complex”

“bwrap needs additive mode; take everything (aside some basics like stdin/out/err acces) by default, then add permissions.”

“Bubblewrap is a good tech to check out and likely a better tool if you're looking for a simpler option”

“What I ended up with was less than 500 lines of code using Claude's suggestion of Bubblewrap”

“Let's me run harnesses and compilers and even headless Firefox in sandboxes without worrying about damage to random parts of my system.”

“an application isolated in this way will have a limited view of the system much less the ability to modify it”

“for GUI apps such as Steam and games where running a separate graphical session isn't practical, you can use bubblewrap.”

“it either requires root or it requires unprivileged user namespaces and it's not x-plat”

“Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.”

“neither the bundled bubblewrap nor the Ubuntu 24.04 bubblewrap works properly under Docker with the default options”

“your Go build fails because you haven't put the local cache dir in the "allowed directories"”

“This is what I currently do, but my software uses docker and docker mounts act as a bypass for the file system restrictions”

“I use bubblewrap, which I believe claude code also has internally but not for its Bash() tool.”

“I do this for things like Steam, games, or other "blackbox" closed source programs that cannot be reasonably trusted.”

“unsharing everything and then adding back everything your agent needs saves the trouble of updating a docker image”

“This makes me feel much more comfortable enabling "yolo" mode and letting the tools do everything.”

“Typically I just want to isolate the agent disallowing it from accessing other parts of the filesystem.”

“whereas with bubblewrap you have to manually bootstrap the availability of each individual dev tool”

“you can use something like bubblewrap[1] or a microVM like libkrun[2] if your goal is light-weight”

“wrapping codex in a launcher that uses bubblewrap to exclude certain files and directories”

“This is a lot less annoying than a container for stuff where I legitimately want to be able to point agents at random stuff”

“On my own machine I just give it a Linux User Namespace, i.e. soft virtualisation via "bubblewrap."”

“It cannot protect /proc and /sys filesystems. So it works only for simplest CLI programs.”

“sandboxing with Firejail and bwrap is quite easy to configure and allows fine-grained permissions”

“I like how these 2 sandboxes allow me to make all the file system r/o except the project folder which is r/w”

“bubblewrap stays lighter but it leak edges if you leave seccomp or fs mounts loose.”

“bwrap is as secure as you want it to be which I think is the primary advantage over anything else”

“bwrap / srt still feel somewhat cumbersome if you think about non tech roles”

“bwrap is much more honest in that regard: it’s just a syscall with no background processes and zero required privileges”

“A basic bubblewrap configuration can expose read-only system tools and have a read/write project directory”

“a simple bubblewrap (Linux) or sandbox-exec (macOS) is probably enough and also much less overhead”

“I like the bubblewrap approach, it just happens to be Linux-only unfortunately.”

“You can use this to be (much) more secure than otherwise, but it's not a security-oriented design”

“bubblewrap is a lot more flexible: You can freely piece together the sandboxed filesystem environment from existing directories, tmpfs, files or data provided via a file descriptor.”

“the pattern using bubblewrap in front of Claude can be exactly duplicated and applied to other coding agents”

“it will do a passable job in protecting you from an automated no-0day attack script”

“from there can take things away to expose as much or little of the host system as needed”