bubblewrap – low-level unprivileged sandboxing tool

bubblewrap is a low-level utility for constructing sandboxed process environments.

Rather than imposing a predefined security policy, it provides the building blocks needed by another application, framework or script to decide what a process can see and access. It creates a new mount namespace with an initially empty root filesystem and lets the caller selectively expose files and directories from the host. This makes bubblewrap useful for application isolation, controlled execution environments and other software that needs a lightweight sandbox without running a separate operating system.

This is free and open source software.

Key Features

• Uses unprivileged Linux user namespaces to construct sandboxes without requiring general root access.
• Always creates a separate mount namespace for the sandboxed process.
• Builds an isolated root filesystem from explicitly selected bind mounts, directories, symbolic links and temporary filesystems.
• Supports read-only and read-write bind mounts.
• Can isolate PID, IPC, network and UTS namespaces.
• Provides a minimal PID 1 process inside a PID namespace to reap child processes correctly.
• Can create a network namespace containing only a loopback interface.
• Accepts seccomp filters for restricting the system calls available to sandboxed processes.
• Uses PR_SET_NO_NEW_PRIVS to prevent acquisition of privileges through setuid programs.
• Allows UID and GID values to be mapped within user namespaces.
• Designed as a policy-neutral foundation which can be integrated into larger sandboxing systems.

Website: github.com/containers/bubblewrap
Support:
Developer: Alexander Larsson and contributors
License: GNU Lesser General Public License v2.0

bubblewrap is written in C and Python. Learn C with our recommended free books and free tutorials. Learn Python with our recommended free books and free tutorials.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.