Bubblewrap (bwrap)
Hacker ApprovedRanked 6 of 10 sandboxing tools by recommenders
A simple Linux sandbox for isolating apps and agents without running a full container. Critics say its limits are real and its isolation is weaker than it looks.
A simple Linux sandbox for isolating apps and agents without running a full container. Critics say its limits are real and its isolation is weaker than it looks.
15 people gave an opinion
- recommend it
- 11
- criticize it
- 4
- approval share
- 73%
Recommended in 7 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 11 people recommend itNeeds 10 or more, met.
- 2.8 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Pairs well with Nix
“The tools to do so are there (e.g. Nix and firejail/bwrap) and, unlike Wayland, they play well with existing software.”
Comment from 2 Feb 2026 in “Noctia: A sleek and minimal desktop shell thoughtfully crafted for Wayland” “I use nix + bwrap, which gives a similar result”
Comment from 18 May 2026 in “The foundations of a provably secure operating system (PSOS) (1979) [pdf]” Lighter than a full container
“to properly sandbox without running a full container”
Comment from 31 May 2026 in “Codex just found a "workaround" of not having sudo on my PC” “At bare minimum use a simple jail such as bwrap”
Comment from 4 Jul 2026 in “I found a malware hiding in my TailwindCSS config file” Used for untrusted code
“I personally use bwrap if I'm not confident about the source.”
Comment from 12 Aug 2026 in “llama.cpp” “At bare minimum use a simple jail such as bwrap”
Comment from 4 Jul 2026 in “I found a malware hiding in my TailwindCSS config file”
What people warn about
Each mark is one comment
Weak isolation and unsafe defaults
“These are massive footguns and issues for deploying code”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” “Codex uses bwrap sandbox which is purely cosmetic”
Comment from 13 Jul 2026 in “Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop” “This only works for post-install script attacks.”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” - Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
Other sandboxing tools people recommend
The four most recommended other sandboxing tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bubblewrap (bwrap) | 109 | 32 | 77% | 12 | — | Approved |
| Agent Safehouse | 43 | 2 | 96% | 7 | — | Approved |
| nono | 34 | 3 | 92% | 10 | — | Approved |
| Firejail | 30 | 6 | 83% | 12 | — | Approved |
| Bubblewrap (bwrap)This page | 11 | 4 | 73% | 7 | — | Approved |
What people said
14 of the 16 comments that mention it, newest first. Each links to the original comment.
“I did a quick look-around last month and decided to start using bwrap.”
“These are massive footguns and issues for deploying code”
“I personally use bwrap if I'm not confident about the source.”
“Codex uses bwrap sandbox which is purely cosmetic”
“At bare minimum use a simple jail such as bwrap”
“to properly sandbox without running a full container”
“I use nix + bwrap, which gives a similar result”
“I did the (imho) only sensible thing, and run Obsidian in a sandbox (bwrap)”
“the bwrap sandbox I’d been using is the perfect place to mount a folder”
“unlike bwrap, it has sane defaults”
“This only works for post-install script attacks.”
“you want to put agents in a sandbox instead such as bwrap anyways”
“bwrap is great, but you're stuck with the limitations of the environment”
“The tools to do so are there (e.g. Nix and firejail/bwrap) and, unlike Wayland, they play well with existing software.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.