bubblewrap
container-ishsandbox-libraryopen sourceAn unprivileged sandboxing tool that confines a process by building it a private mount-namespace filesystem view.
documentedcontainers/bubblewrap README ↗
bubblewrap (bwrap) achieves filesystem confinement differently from Landlock: instead of path rules over the real tree, it builds the process a new mount namespace, a private, synthetic filesystem view. It bind-mounts only the host paths you allow (read-only by default, writable via explicit --bind), so the sandboxed process literally cannot see anything you did not mount in. It uses user namespaces to do this unprivileged, and is the engine under Flatpak. Paired with seccomp for filtering, it is the filesystem primitive Claude Code leans on for its Linux sandbox.
Strengths
- Unprivileged, self-imposed, inherited by children
- Synthetic filesystem view, the process only sees what you mount in
- Battle-tested as the sandbox engine under Flatpak
Limitations
- Requires user namespaces enabled on the host
- Filesystem confinement only, pair with seccomp for syscall filtering
- Shared kernel, not a VM boundary