projectatomic/bubblewrap
Bubblewrap
Bubblewrap is an unprivileged sandbox execution utility for Linux that isolates processes from the host system. It creates secure environments by leveraging Linux namespaces to separate system resources, including network, PID, and IPC stacks.
The project distinguishes itself by enabling the execution of untrusted software without requiring root privileges on the host machine. It prevents privilege escalation by disabling the execution of setuid binaries and uses user identity mapping to isolate process permissions from the host operating system.
The tool manages a comprehensive security surface that includes filesystem access control for restricting directory visibility and read-only permissions. It further reduces the kernel attack surface through seccomp system call filtering.
Features
- Linux Sandboxes - Creates isolated execution environments using Linux kernel primitives to restrict resource access and system visibility.
- Mount-Namespace Virtualization - Provides a restricted filesystem view by isolating mount points and enforcing read-only permissions.
- Container User Identity Mapping - Translates internal sandbox user identities to host identities to isolate process permissions from the host system.
- Unprivileged Container Execution - Enables the execution of applications in isolated environments without requiring root privileges on the host machine.
- Process Isolation - Restricts process access to system resources by creating private network, PID, and IPC instances.
- Namespace-Based Isolation - Implements isolated environments using Linux kernel namespaces to separate network, PID, and IPC stacks from the host.
- Process User Isolation - Redefines user and group identities to isolate process permissions from the host operating system.
- Isolated Execution Sandboxes - Executes processes in a secure, unprivileged environment using Linux namespaces for isolation.
- System Call Surface Minimizers - Reduces the kernel attack surface by restricting the available host system call interface using seccomp.
- Privilege Escalation Prevention - Prevents privilege escalation by blocking the execution of setuid binaries within the sandboxed environment.
- Read-Only Filesystem Enforcement - Enforces read-only access and restricts visibility of host directories within the secure execution environment.
- System Call Filter Analysis - Limits the specific kernel syscalls a process can execute by applying seccomp filters.
- Seccomp Profiles - Applies seccomp filter profiles to restrict the set of kernel system calls a process can execute.
- Sandboxing and Isolation - Sandboxing tool using namespaces without requiring root.
