Bubblewrap

Bubblewrap este un utilitar de execuție sandbox neprivilegiat pentru Linux care izolează procesele de sistemul gazdă. Acesta creează medii securizate prin utilizarea namespace-urilor Linux pentru a separa resursele sistemului, inclusiv stivele de rețea, PID și IPC.

Proiectul se distinge prin permiterea execuției software-ului neîncredere fără a necesita privilegii de root pe mașina gazdă. Previne escaladarea privilegiilor prin dezactivarea execuției binarelor setuid și utilizează maparea identității utilizatorului pentru a izola permisiunile procesului de sistemul de operare gazdă.

Instrumentul gestionează o suprafață de securitate cuprinzătoare care include controlul accesului la sistemul de fișiere pentru restricționarea vizibilității directoarelor și permisiuni read-only. De asemenea, reduce suprafața de atac a kernel-ului prin filtrarea apelurilor de sistem seccomp.

Features

Linux Sandboxes - Creates isolated execution environments using Linux kernel primitives to restrict resource access and system visibility.
Mount-Namespace Virtualization - Provides a restricted filesystem view by isolating mount points and enforcing read-only permissions.
Container User Identity Mapping - Translates internal sandbox user identities to host identities to isolate process permissions from the host system.
Unprivileged Container Execution - Enables the execution of applications in isolated environments without requiring root privileges on the host machine.
Process Isolation - Restricts process access to system resources by creating private network, PID, and IPC instances.
Namespace-Based Isolation - Implements isolated environments using Linux kernel namespaces to separate network, PID, and IPC stacks from the host.
Process User Isolation - Redefines user and group identities to isolate process permissions from the host operating system.
Isolated Execution Sandboxes - Executes processes in a secure, unprivileged environment using Linux namespaces for isolation.
System Call Surface Minimizers - Reduces the kernel attack surface by restricting the available host system call interface using seccomp.
Privilege Escalation Prevention - Prevents privilege escalation by blocking the execution of setuid binaries within the sandboxed environment.
Read-Only Filesystem Enforcement - Enforces read-only access and restricts visibility of host directories within the secure execution environment.
System Call Filter Analysis - Limits the specific kernel syscalls a process can execute by applying seccomp filters.
Seccomp Profiles - Applies seccomp filter profiles to restrict the set of kernel system calls a process can execute.
Sandboxing and Isolation - Sandboxing tool using namespaces without requiring root.

Istoric stele

projectatomicbubblewrap

Name: projectatomic/bubblewrap
Author: projectatomic

View on GitHub

7,731 stele356 fork-uriC1 vizualizare

Bubblewrap

Features

Linux Sandboxes - Creates isolated execution environments using Linux kernel primitives to restrict resource access and system visibility.
Mount-Namespace Virtualization - Provides a restricted filesystem view by isolating mount points and enforcing read-only permissions.
Container User Identity Mapping - Translates internal sandbox user identities to host identities to isolate process permissions from the host system.
Unprivileged Container Execution - Enables the execution of applications in isolated environments without requiring root privileges on the host machine.
Process Isolation - Restricts process access to system resources by creating private network, PID, and IPC instances.
Namespace-Based Isolation - Implements isolated environments using Linux kernel namespaces to separate network, PID, and IPC stacks from the host.
Process User Isolation - Redefines user and group identities to isolate process permissions from the host operating system.
Isolated Execution Sandboxes - Executes processes in a secure, unprivileged environment using Linux namespaces for isolation.
System Call Surface Minimizers - Reduces the kernel attack surface by restricting the available host system call interface using seccomp.
Privilege Escalation Prevention - Prevents privilege escalation by blocking the execution of setuid binaries within the sandboxed environment.
Read-Only Filesystem Enforcement - Enforces read-only access and restricts visibility of host directories within the secure execution environment.
System Call Filter Analysis - Limits the specific kernel syscalls a process can execute by applying seccomp filters.
Seccomp Profiles - Applies seccomp filter profiles to restrict the set of kernel system calls a process can execute.
Sandboxing and Isolation - Sandboxing tool using namespaces without requiring root.

Alternative open-source pentru Bubblewrap

Proiecte open-source similare, clasificate după numărul de funcționalități comune cu Bubblewrap.

netblue30/firejail
netblue30/firejail
7,069Vezi pe GitHub
Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host system. It uses kernel namespaces and seccomp filters to restrict filesystem access, drop kernel capabilities, and limit the system attack surface. The project is distinguished by its use of predefined security profiles to automatically apply filesystem restrictions and syscall limits based on the executable being launched. It provides specialized isolation for portable packages such as AppImages and implements X11 display isolation via proxy servers to prevent keyboard loggi
C
Vezi pe GitHub7,069
containers/bubblewrap
containers/bubblewrap
5,839Vezi pe GitHub
Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted applications. It combines Linux user, mount, network, PID, and UTS namespaces with seccomp-BPF system call filtering to restrict filesystem, network, process, and inter-process communication access. The project provides comprehensive process isolation by giving each sandbox its own private tmpfs root with selective bind-mounts, a separate network stack containing only a loopback interface, an independent process ID space, and remapped user and group identifiers. It applies secc
Clinux-containersuser-namespaces
Vezi pe GitHub5,839
ioi/isolate
ioi/isolate
1,441Vezi pe GitHub
Isolate is a low-level sandbox designed to execute untrusted programs within a strictly controlled environment. It functions as a process isolation engine that prevents potentially harmful code from interacting with or damaging the host operating system. The tool leverages Linux kernel primitives, including namespaces and control groups, to partition system resources and enforce hardware usage boundaries. By applying filesystem virtualization and system call filtering, it restricts the visibility and interaction of a process with the host, ensuring that untrusted applications operate only wit
C
Vezi pe GitHub1,441
youki-dev/youki
youki-dev/youki
7,452Vezi pe GitHub
Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open Container Initiative specifications. It serves as an execution engine that can function as a rootless container manager or a pluggable Kubernetes CRI runtime to manage pods and containers within a cluster. The project distinguishes itself by providing a Wasm container runtime capable of executing WebAssembly modules as isolated workloads compatible with standard orchestration tools. It further supports a rootless execution model, allowing isolated environments to start as non-
Rustcontainersdockerkubernetes
Vezi pe GitHub7,452

Vezi toate cele 30 alternative pentru Bubblewrap

Întrebări frecvente

Ce face projectatomic/bubblewrap?

Care sunt principalele funcționalități ale projectatomic/bubblewrap?

Principalele funcționalități ale projectatomic/bubblewrap sunt: Linux Sandboxes, Mount-Namespace Virtualization, Container User Identity Mapping, Unprivileged Container Execution, Process Isolation, Namespace-Based Isolation, Process User Isolation, Isolated Execution Sandboxes.

Care sunt câteva alternative open-source pentru projectatomic/bubblewrap?

Alternativele open-source pentru projectatomic/bubblewrap includ: netblue30/firejail — Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host… containers/bubblewrap — Bubblewrap is a Linux sandbox runner that creates lightweight, isolated execution environments for running untrusted… ioi/isolate — Isolate is a low-level sandbox designed to execute untrusted programs within a strictly controlled environment. It… youki-dev/youki — Youki is a low-level container runtime written in Rust that creates and manages isolated containers according to Open… flatpak/flatpak — Flatpak is a sandboxed application framework and standardized packaging format for Linux desktop applications. It… mviereck/x11docker — x11docker is an OCI container GUI orchestrator and hardware bridge designed to execute graphical applications and full…