containers/bubblewrap on Hacker News

Bubblewrap is a good tool in this space https://github.com/containers/bubblewrap

comment by klooney · 2023-03-23 · in The Unix process API is unreliable and unsafe (2021)

…[2] http://eradman.com/entrproject/ [3] https://watchexec.github.io/ [4] https://github.com/containers/bubblewrap

comment by jamesdutc · 2023-03-22 · in The Unix process API is unreliable and unsafe (2021)

…or an existing FaaS (Lambda, Deno Deploy, Cloudflare Workers) or FaaSaaS (Deno Subhosting) [1] - https://github.com/containers/bubblewrap

comment by stevekrouse · 2023-01-11 · in Show HN: Val Town – A Cloud Scripting Site

…seen projects use it in the wild to close files or free memory in branchy functions. [1] [1] https://github.com/containers/bubblewrap/blob/c54bbc6d7b78e7...

comment by stabbles · 2023-01-07 · in Modern C for C++ peeps (2019)

…and others are doing fantastic work modernizing Linux (see Flatpak, Fedora Silverblue, etc.). [1] https://github.com/containers/bubblewrap

comment by danieldk · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30

…://ipset.netfilter.org/iptables-extensions.man.html [2] - https://github.com/netblue30/firejail [3] - https://github.com/containers/bubblewrap

comment by LinuxBender · 2022-11-08 · in Microsoft is phoning home the content of PowerPoint slides

How does this approach for sandboxing compare to the bubblewrap that uses namespaces? https://github.com/containers/bubblewrap

comment by Cloudef · 2022-07-15 · in Show HN: Porting OpenBSD Pledge() to Linux

…or connect to a custom server. By the way, on linux you can easily achieve a sandbox using bwrap https://github.com/containers/bubblewrap

comment by Cloudef · 2022-07-05 · in Reverse Engineering Dark Souls 3 Networking

…balance between inconvenience and security. I use it to wrap different package managers like npm. https://github.com/containers/bubblewrap

comment by Mr_Yolokovich · 2022-06-27 · in PyPI: Python packets steal AWS keys from users

…for that container so you can edit, and then on exit the changes vanish. Might try this actually :) https://github.com/containers/bubblewrap

comment by XorNot · 2022-06-05 · in Painless desktop containers for everyday development

…useless, though I do really like Fedora's default scopes and have used them successfully). [1] https://github.com/containers/bubblewrap

comment by XorNot · 2022-04-11 · in Node.js packages don't deserve trust

not very good name considering there is sandboxing tool for linux with the same name https://github.com/containers/bubblewrap

comment by Cloudef · 2022-03-28 · in Bubblewrap CLI: Create Android application that launches PWAs

My reading of https://github.com/containers/bubblewrap#related-project-com... is that it is literally what flatpak uses: > Firejail is similar to Flatpak before bubblewrap was split out

comment by yjftsjthsd-h · 2022-03-28 · in Bubblewrap: Unprivileged sandboxing tool for Linux

…its importance. It's frustrating to have such a useful tool be knowingly easy to misuse. [0]: https://github.com/containers/bubblewrap/issues/142

comment by rsa25519 · 2022-03-27 · in Bubblewrap: Unprivileged sandboxing tool for Linux

"How does it compare to firejail?" you were going to ask: https://github.com/containers/bubblewrap#related-project-com... . You're welcome.

comment by skywal_l · 2022-03-27 · in Bubblewrap: Unprivileged sandboxing tool for Linux

▲ 189

Bubblewrap: Unprivileged sandboxing tool for Linux

story by varbhat · 2022-03-27 · 49 comments

I don't know why it says that, it's explicitly not: https://github.com/containers/bubblewrap/blob/34a8c8bc870783... Distros without user namespaces will probably still ship the SUID version though.

comment by throwaway82652 · 2022-03-27 · in Firejail: Linux namespaces and seccomp-bpf sandbox

…could be viewed as *setuid* implementation of a subset of user namespaces. Emphasis on subset [...] https://github.com/containers/bubblewrap#user-namespaces=

comment by traverseda · 2022-03-27 · in Firejail: Linux namespaces and seccomp-bpf sandbox

…the hood. There are a couple of meaningful differences which may or may not be important to you: https://github.com/containers/bubblewrap#related-project-com... Personally, I like that Bubblewrap doesn't require the same level of…

comment by danShumway · 2022-03-27 · in Firejail: Linux namespaces and seccomp-bpf sandbox

…flatpak? bubblewrap, used by flatpak for isolation, seems less readily escapable than firejail ( https://github.com/containers/bubblewrap/blob/master/README.... ). (edit: changed link formatting)

comment by dustyharddrive · 2021-12-04 · in Ask HN: What's the best way to secure your workstation?

▲ 2

Bubblewrap: Unprivileged Sandboxing Tool

story by ingve · 2021-10-03 · 0 comments

…files to store things that need to be mounted when one wants to run an application[1]. [0] https://github.com/containers/bubblewrap [1] https://www.freecodecamp.org/news/managing-ubuntu-snaps/

comment by esarbe · 2021-08-27 · in I switched from macOS to Linux after 15 years of Apple

…in the upstream kernel since 2013.) If you want to do this at scale, a handy tool is bwrap(1) from https://github.com/containers/bubblewrap . (The README talks about how bwrap is a setuid program to prevent the need for that sysctl, but it…

comment by geofft · 2021-07-22 · in Implement unprivileged chroot

An alternative to unshare is also bubblewrap ( https://github.com/containers/bubblewrap ) which also sets up a new namespace. You can build up your own new filesystem by binding existing paths into the new root and then run a process…

comment by dividuum · 2021-07-22 · in Implement unprivileged chroot

…for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap

comment by zxzax · 2021-06-23 · in Flatpak – A Security Nightmare

…and get you an apparent-root shell? If so, you can install rootless Docker in your homedir, or use https://github.com/containers/bubblewrap . (A few years back I wrote https://github.com/twosigma/debootwrap which ties together bubblewrap…

comment by geofft · 2021-02-23 · in You need to be able to run your system

▲ 2

Bubblewrap – Unprivileged Sandboxing Tool

story by taf2 · 2020-12-31 · 0 comments

…On the server, we use bubblewrap, a similar tool (comparison with firejail is in bubblewrap readme) https://github.com/containers/bubblewrap

comment by srgpqt · 2020-11-10 · in Firejail – Sandbox Linux Applications

…the wheel. It's the kernel providing most of the functionality for containerization anyways. [0] https://github.com/containers/bubblewrap

comment by bryanlarsen · 2020-10-30 · in Valve put their 'Pressure Vessel' container source for Linux games up on Gitlab

…which has been adopted by the community for other purposes, such as Gnome's Epiphany browser. https://github.com/containers/bubblewrap https://blogs.gnome.org/mcatanzaro/2020/03/11/epiphany-3-36-... SnapCraft on the other hand is a project…

comment by the_why_of_y · 2020-04-25 · in Disabling Snaps in Ubuntu 20.04

See also bubblewrap https://github.com/containers/bubblewrap

comment by emmelaich · 2020-01-13 · in Show HN: Sandy – A tiny Sandbox to run untrusted code ️

…which straightforwardly gives them full root. Another project in this space is bubblewrap https://github.com/containers/bubblewrap , which can run either with unprivileged user namespaces or by being setuid. It's intended to create an…

comment by geofft · 2019-12-18 · in Linux 3.8 introduced unprivileged user namespaces [pdf]

Bubblewrap ( https://github.com/containers/bubblewrap ) on Wayland. You might have to make a chroot sort of environment for it for it to be convenient enough to use in practice unless you’re okay with exposing the (read-only) contents of…

comment by minitech · 2019-11-10 · in We are making Sandboxie a free tool, with plans to transition it to open source

You might be interested in bwrap.[0] [0]: https://github.com/projectatomic/bubblewrap

comment by proaralyst · 2018-10-12 · in OpenBSD's unveil()

Yes. The sandbox tool used by Flatpak is "bubblewrap", which has an overview here: https://github.com/projectatomic/bubblewrap/blob/master/READ... There is nothing against Flatpak using user namepsaces when the developers feel a bit more…

comment by Jasper_ · 2018-10-09 · in Flatpak – a security nightmare

…also want to have a look at bwrap [1], a handy little sandboxing tool for unprivileged users. [1]: https://github.com/projectatomic/bubblewrap

comment by Liskni_si · 2018-09-26 · in Killing processes that don't want to die

https://github.com/projectatomic/bubblewrap This is the most promising one I've seen.

comment by bthornbury · 2018-09-25 · in Show HN: Plash – Build and run containers

If you want to learn more about container security I recommend https://blog.jessfraz.com/ and https://github.com/projectatomic/bubblewrap

comment by wmf · 2018-06-25 · in Docker Considered Harmful (2016)

Put it in a sandbox without network access. https://github.com/projectatomic/bubblewrap might be worth looking at for that. It also has the added benefit of reducing the attack surface of running w3m on untrusted content.

comment by dividuum · 2017-12-12 · in How Email open tracking quietly took over the web

…[2] https://blog.jessfraz.com/post/getting-towards-real-sandbox-... [3] https://github.com/projectatomic/bubblewrap

comment by ohthehugemanate · 2017-12-07 · in Kata Containers – The speed of containers, the security of VMs

This seems very similar to Bubblewrap: https://github.com/projectatomic/bubblewrap

comment by jeblair · 2017-10-15 · in Nsjail – A light-weight process isolation tool for Linux

Perhaps it depends whether you see sandboxing as a tool or as a feature. There is https://github.com/projectatomic/bubblewrap if you want sandboxing without systemd.

comment by wmf · 2016-11-04 · in New sandbox features in systemd

▲ 91

Bubblewrap: Unprivileged sandboxing tool

story by groks · 2016-08-07 · 8 comments

Bubblewrap is a similar tool which carefully handles it's setuid responsibilities: https://github.com/projectatomic/bubblewrap#related-project-...

comment by groks · 2016-08-07 · in Firejail – security sandbox