{"slug": "bubblewrap", "name": "bubblewrap", "category": "security", "category_name": "Security and passwords", "description": "Unprivileged Linux sandboxing tool using namespaces; the sandbox underneath Flatpak.", "recommenders": 23, "commenters": 32, "warners": 1, "score": 19.773, "rising": -0.89, "first": "2025-11-09", "latest": "2026-10-22", "why": "HN commenters use it as a lightweight Linux sandbox for AI coding agents and for package managers and other untrusted software, with fine-grained control over mounts, namespaces and network access.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 22, "neutral": 10, "compare": 2, "warn": 1}, "spark": [3, 1, 1, 3, 1, 1, 0, 3, 4, 3, 0, 2], "listed": true, "loved": ["Sandboxing AI agents", "Fine-grained isolation"], "caveat": "Tedious setup", "short_quote": "I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system.", "icon": true, "domain": null, "github_repo": "github.com/containers/bubblewrap", "official_url": "https://github.com/containers/bubblewrap", "pricing": "open source", "aliases": ["bubblewrap", "Bubblewrap"], "verdict": [{"text": "HN commenters use it as a lightweight Linux sandbox for AI coding agents", "cites": [{"id": 733875568, "item_id": 45867223, "url": "https://news.ycombinator.com/item?id=45867223", "by": "qwertox", "date": "2025-11-09", "stance": "recommend", "quote": "I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system.", "excerpt": "Bubblewrap is a really interesting project, really worth checking out. https://github.com/containers/bubblewrap It's the base for Flatpack, the thing that makes Flatpack be sandboxed. I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system. You can bind directories into it, or overlay them into it, restrict other kinds of access. If Docker is a thing in a scale", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Using bubblewrap to add sandboxing to NetBSD"}, {"id": 787873920, "item_id": 49242120, "url": "https://news.ycombinator.com/item?id=49242120", "by": "frumiousirc", "date": "2026-08-10", "stance": "recommend", "quote": "I use bubblewrap, which I believe claude code also has internally", "excerpt": "I use bubblewrap, which I believe claude code also has internally but not for its `Bash()` tool. I wrap bubblewrap in a script that supports config files to allow different \"profiles\" of use (analogous to eg firefox profiles). The bwrap starts with the whole filesystem mounted read-only, then mounts the current directory read-write and then applies further bind mounts for devices, special case other read-write (eg, ~", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 754138192, "item_id": 47133637, "url": "https://news.ycombinator.com/item?id=47133637", "by": "l332mn", "date": "2026-02-23", "stance": "recommend", "quote": "I use bubblewrap to sandbox the agent to my projects folder", "excerpt": "I use bubblewrap to sandbox the agent to my projects folder, where the ai gets free read/write reign. Non-synthetic env cars are symlinked into my projects folder from outside that folder.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 782462176, "item_id": 48903886, "url": "https://news.ycombinator.com/item?id=48903886", "by": "SwellJoe", "date": "2026-07-14", "stance": "recommend", "quote": "for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity.", "excerpt": "I used lxc many years ago and used to support it in my company's products, but for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity. Any full container or VM thing is much heavier than a namespace with some bind mounts, which is what bubblewrap does. I started out implementing it with podnan, but that's also far too heavy and complicated, as you need to equip", "context": "", "use_case": "sandboxing coding agents", "switched_from": "Podman", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 742518273, "item_id": 46407392, "url": "https://news.ycombinator.com/item?id=46407392", "by": "throwayaw84330", "date": "2025-12-27", "stance": "recommend", "quote": "bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster)", "excerpt": "I use https://github.com/longregen/claude-sandbox It uses bubblewrap (no root needed) and only exposes ~/.cache stuff and the current folder (no git credentials, no ssh credentials, and as few permissions as it's feasible). bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster), but has the same underlying mechanisms for security (cgroups)", "context": "", "use_case": "sandboxing without root", "switched_from": "", "story": "Ask HN: How are you sandboxing coding agents?"}]}, {"text": " and for package managers and other untrusted software,", "cites": [{"id": 761322432, "item_id": 47582652, "url": "https://news.ycombinator.com/item?id=47582652", "by": "himata4113", "date": "2026-03-30", "stance": "recommend", "quote": "I recommend everyone to use bwrap if you're on linux and alias all package managers", "excerpt": "I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW", "context": "Linux user", "use_case": "sandboxing package managers", "switched_from": "", "story": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan"}, {"id": 800563712, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "most things that I run that aren't from my distro's repos get their own bubblewrap", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "sandboxing apps", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 778668481, "item_id": 48666780, "url": "https://news.ycombinator.com/item?id=48666780", "by": "gandreani", "date": "2026-06-24", "stance": "recommend", "quote": "I run it sandboxed with https://github.com/containers/bubblewrap", "excerpt": "I use both the openai subscription and the opencode go subscription. I use the go subscription for my personal work and the openai subscription for my consulting work. The differences between the models are minimal, but I usually stick with gpt-5.4-mini, gpt-5.4, mimo-pro-2.5, deepseek-v4-pro. These latter ones have way more usage than even using 5.4-mini so I tend to use them in personal projects for that reason. My", "context": "", "use_case": "sandboxing the harness", "switched_from": "", "story": "GLM-5.2 is the step change for open agents"}]}, {"text": " with fine-grained control over mounts, namespaces and network access.", "cites": [{"id": 736684032, "item_id": 46042752, "url": "https://news.ycombinator.com/item?id=46042752", "by": "codedokode", "date": "2025-11-24", "stance": "recommend", "quote": "I am using bwrap - it allows blocking network, creating a new process namespace", "excerpt": "I am using bwrap - it allows blocking network, creating a new process namespace (so that sandboxed program cannot mess with host processes) and creating a new filesystem, where you can mount host directories. I only pass through minimal set of directories like /usr and /lib, and only selected files from /etc, as they can contain valuable information. I also pass through several device files like /dev/null, but not th", "context": "", "use_case": "sandboxing untrusted apps", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}, {"id": 782060640, "item_id": 48878790, "url": "https://news.ycombinator.com/item?id=48878790", "by": "phaseleza", "date": "2026-07-11", "stance": "recommend", "quote": "I use bubblewrap to unshare all namespaces (net, pid, ipc, user)", "excerpt": "I use bubblewrap to unshare all namespaces (net, pid, ipc, user) and ro-bind necessary system paths like /etc, /lib, create a tmpfs home, mount the project folder under it (writable), then mount tmpfs over sensitive directories inside the project to hide them. For the network part, a daemon outside the sandbox serves a filtering HTTP proxy on a Unix socket. I mount the Unix socket into the sandbox and bridge it to lo", "context": "", "use_case": "sandboxing coding tools", "switched_from": "", "story": "What xAI's Grok Build CLI Actually Sends to xAI"}, {"id": 746050944, "item_id": 46628184, "url": "https://news.ycombinator.com/item?id=46628184", "by": "flakes", "date": "2026-01-14", "stance": "recommend", "quote": "I find it better to bubblewrap against a full sandbox directory.", "excerpt": "I find it better to bubblewrap against a full sandbox directory. Using docker, you can export an image to a single tarball archive, flattening all layers. I use a compatible base image for my kernel/distro, and unpack the image archive into a directory. With the unpack directory, you can now limit the host paths you expose, avoiding leaking in details from your host machine into the sandbox. bwrap --ro-bind image/ / ", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}]}, {"text": " The most common complaint is tedious, trial-and-error setup,", "cites": [{"id": 800563712, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "most things that I run that aren't from my distro's repos get their own bubblewrap", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "sandboxing apps", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 800313201, "item_id": 50019575, "url": "https://news.ycombinator.com/item?id=50019575", "by": "gandreani", "date": "2026-10-09", "stance": "neutral", "quote": "I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace", "excerpt": "I agree! I can't comment on the design of the SDKs but from the looks of it this is a great option to integrate into agent harnesses/pipelines. The \"audit\" and \"debug\" mode are specially useful. I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace to figure out all the harnesses dependencies.", "context": "", "use_case": "sandboxing agent harnesses", "switched_from": "", "story": "MXC - a sandboxed code execution system"}, {"id": 782898547, "item_id": 48931159, "url": "https://news.ycombinator.com/item?id=48931159", "by": "subscribed", "date": "2026-07-15", "stance": "neutral", "quote": "running it in the bwrap (pain in the ass in itself)", "excerpt": "Not my experience. I use Claude to build me a small web app I needed for ages, I'm using its superpowers to discuss/talk about architecture /brainstorm/build plans, and always a fresh context with the built plans. A few times the plan implementer (subagent writing a code assigned to the task) found something lacking (more often it was test issue related to the code, not the actual flaw of the implementation plan), fi", "context": "", "use_case": "sandboxing agent", "switched_from": "", "story": "Microsoft Patches a Record 570 Security Flaws"}, {"id": 733863680, "item_id": 45866480, "url": "https://news.ycombinator.com/item?id=45866480", "by": "aborsy", "date": "2025-11-09", "stance": "recommend", "quote": "I experimented bubblewrap as a better alternative to firejail.", "excerpt": "I experimented bubblewrap as a better alternative to firejail. Unfortunately there are scripts for few applications. It\u2019s tool for developers. Users are better off flatpaks powered by bubblewrap .", "context": "", "use_case": "application sandboxing", "switched_from": "firejail", "story": "Using bubblewrap to add sandboxing to NetBSD"}]}, {"text": " and one warns that sharing the host kernel leaves it one exploit away from root, unlike a VM.", "cites": [{"id": 788935363, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "warn", "quote": "Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Firefox is now the last major browser that still supports uBlock Origin"}]}], "praise": [{"label": "Sandboxing AI agents", "summary": "Widely used to confine Claude Code, Codex and other agents to the project directory, hiding SSH keys and $HOME.", "quotes": [{"id": 733875568, "item_id": 45867223, "url": "https://news.ycombinator.com/item?id=45867223", "by": "qwertox", "date": "2025-11-09", "stance": "recommend", "quote": "I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system.", "excerpt": "Bubblewrap is a really interesting project, really worth checking out. https://github.com/containers/bubblewrap It's the base for Flatpack, the thing that makes Flatpack be sandboxed. I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system. You can bind directories into it, or overlay them into it, restrict other kinds of access. If Docker is a thing in a scale", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Using bubblewrap to add sandboxing to NetBSD"}, {"id": 754493155, "item_id": 47155822, "url": "https://news.ycombinator.com/item?id=47155822", "by": "downsplat", "date": "2026-02-25", "stance": "recommend", "quote": "I use a bubblewrap wrapper to make sure it can't read $HOME or access my ssh keys.", "excerpt": "I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it c", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Sandboxes won't save you from OpenClaw"}, {"id": 783959040, "item_id": 48997440, "url": "https://news.ycombinator.com/item?id=48997440", "by": "jboss10", "date": "2026-07-21", "stance": "recommend", "quote": "I've written an alias for bwrap which only gives the agent access to the cir dir.", "excerpt": "I use this setup aswel. I've written an alias for bwrap which only gives the agent access to the cir dir. Have you managed to setup any firewall or protection for the API keys?", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Stop Using OpenCode"}]}, {"label": "Fine-grained isolation", "summary": "Lets users unshare namespaces, bind-mount only needed paths read-only, and cut or proxy network access.", "quotes": [{"id": 782060640, "item_id": 48878790, "url": "https://news.ycombinator.com/item?id=48878790", "by": "phaseleza", "date": "2026-07-11", "stance": "recommend", "quote": "I use bubblewrap to unshare all namespaces (net, pid, ipc, user)", "excerpt": "I use bubblewrap to unshare all namespaces (net, pid, ipc, user) and ro-bind necessary system paths like /etc, /lib, create a tmpfs home, mount the project folder under it (writable), then mount tmpfs over sensitive directories inside the project to hide them. For the network part, a daemon outside the sandbox serves a filtering HTTP proxy on a Unix socket. I mount the Unix socket into the sandbox and bridge it to lo", "context": "", "use_case": "sandboxing coding tools", "switched_from": "", "story": "What xAI's Grok Build CLI Actually Sends to xAI"}, {"id": 736684032, "item_id": 46042752, "url": "https://news.ycombinator.com/item?id=46042752", "by": "codedokode", "date": "2025-11-24", "stance": "recommend", "quote": "I am using bwrap - it allows blocking network, creating a new process namespace", "excerpt": "I am using bwrap - it allows blocking network, creating a new process namespace (so that sandboxed program cannot mess with host processes) and creating a new filesystem, where you can mount host directories. I only pass through minimal set of directories like /usr and /lib, and only selected files from /etc, as they can contain valuable information. I also pass through several device files like /dev/null, but not th", "context": "", "use_case": "sandboxing untrusted apps", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}, {"id": 746050944, "item_id": 46628184, "url": "https://news.ycombinator.com/item?id=46628184", "by": "flakes", "date": "2026-01-14", "stance": "recommend", "quote": "I find it better to bubblewrap against a full sandbox directory.", "excerpt": "I find it better to bubblewrap against a full sandbox directory. Using docker, you can export an image to a single tarball archive, flattening all layers. I use a compatible base image for my kernel/distro, and unpack the image archive into a directory. With the unpack directory, you can now limit the host paths you expose, avoiding leaking in details from your host machine into the sandbox. bwrap --ro-bind image/ / ", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}]}, {"label": "Lightweight", "summary": "Seen as lighter and faster to launch than Docker, Podman or VMs while still isolating well.", "quotes": [{"id": 782462176, "item_id": 48903886, "url": "https://news.ycombinator.com/item?id=48903886", "by": "SwellJoe", "date": "2026-07-14", "stance": "recommend", "quote": "for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity.", "excerpt": "I used lxc many years ago and used to support it in my company's products, but for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity. Any full container or VM thing is much heavier than a namespace with some bind mounts, which is what bubblewrap does. I started out implementing it with podnan, but that's also far too heavy and complicated, as you need to equip", "context": "", "use_case": "sandboxing coding agents", "switched_from": "Podman", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 742518273, "item_id": 46407392, "url": "https://news.ycombinator.com/item?id=46407392", "by": "throwayaw84330", "date": "2025-12-27", "stance": "recommend", "quote": "bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster)", "excerpt": "I use https://github.com/longregen/claude-sandbox It uses bubblewrap (no root needed) and only exposes ~/.cache stuff and the current folder (no git credentials, no ssh credentials, and as few permissions as it's feasible). bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster), but has the same underlying mechanisms for security (cgroups)", "context": "", "use_case": "sandboxing without root", "switched_from": "", "story": "Ask HN: How are you sandboxing coding agents?"}, {"id": 799567488, "item_id": 49972968, "url": "https://news.ycombinator.com/item?id=49972968", "by": "johnsmith1840", "date": "2026-10-06", "stance": "recommend", "quote": "Bubblewrap is a good tech to check out and likely a better tool if you're looking for a simpler option.", "excerpt": "For my assumed goal of yours I would say none of these are good options. A simple VM or ec2 node hosting a coding sandbox is likely the better option. All 3 of these are vastly different tech. Confusingly, you could run all 3 of these at the same time. I know that probally doesn't help. If you want to learn more I'd go get a linux machine somewhere like aws and play around with them. A local agent harness is a \"light", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Linux containers in 500 lines of code (2016)"}]}, {"label": "Easy to script", "summary": "Commenters wrap it in small scripts, aliases or profile configs to make it convenient to reuse.", "quotes": [{"id": 782682577, "item_id": 48917661, "url": "https://news.ycombinator.com/item?id=48917661", "by": "lionkor", "date": "2026-07-15", "stance": "recommend", "quote": "it's a wrapper around bubblewrap, which works quite well.", "excerpt": "I use sandbox-here for this reason, it's a wrapper around bubblewrap, which works quite well. Copy the code and adjust it to your liking: https://github.com/lionkor/sbh I have a shell alias for it, and use it like sbh --net pi for example or sbh --net codex and maybe add --docker if I expect it to do docker things. This kind of wrapper is much easier to handle and maintain than a completely separate tool for sandboxi", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "I tricked Claude into leaking your deepest, darkest secrets"}, {"id": 787873920, "item_id": 49242120, "url": "https://news.ycombinator.com/item?id=49242120", "by": "frumiousirc", "date": "2026-08-10", "stance": "recommend", "quote": "I use bubblewrap, which I believe claude code also has internally", "excerpt": "I use bubblewrap, which I believe claude code also has internally but not for its `Bash()` tool. I wrap bubblewrap in a script that supports config files to allow different \"profiles\" of use (analogous to eg firefox profiles). The bwrap starts with the whole filesystem mounted read-only, then mounts the current directory read-write and then applies further bind mounts for devices, special case other read-write (eg, ~", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 798894082, "item_id": 49930880, "url": "https://news.ycombinator.com/item?id=49930880", "by": "lionkor", "date": "2026-10-02", "stance": "neutral", "quote": "a slop cannon wrapper around `bubblewrap`", "excerpt": "My $0.02; I use pi every day, it's always running somewhere for various kinds of tasks (no vibe coding). I run it in `sbh`, a slop cannon wrapper around `bubblewrap` that ensures that the agent only has access to things it could possibly need. The code is short and you can audit it yourself. I run it like `sbh --net pi` or `sbh --net --docker pi` depending if I want the agent to have docker access. The result is that", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Pi 1.0"}]}, {"label": "Supply-chain protection", "summary": "Used to wrap npm, pip, cargo and other package managers to limit the blast radius of malicious packages.", "quotes": [{"id": 761322432, "item_id": 47582652, "url": "https://news.ycombinator.com/item?id=47582652", "by": "himata4113", "date": "2026-03-30", "stance": "recommend", "quote": "I recommend everyone to use bwrap if you're on linux and alias all package managers", "excerpt": "I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW", "context": "Linux user", "use_case": "sandboxing package managers", "switched_from": "", "story": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan"}, {"id": 800563712, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "most things that I run that aren't from my distro's repos get their own bubblewrap", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "sandboxing apps", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 787831073, "item_id": 49239442, "url": "https://news.ycombinator.com/item?id=49239442", "by": "SwellJoe", "date": "2026-08-09", "stance": "neutral", "quote": "I made a tool to bubblewrap any agent", "excerpt": "I made a tool to bubblewrap any agent (well, any agent I've used more than once), so I can run them in whatever YOLO mode they have with a pretty reasonable level of safety (it protects the rest of the system against prompt injections and supply chain attacks, it can and doesn't try to protect the project being worked on from either). https://github.com/swelljoe/flar", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}]}], "caveats": [{"label": "Tedious setup", "summary": "Configuring it is manual work, often needing rounds of strace to find what a tool depends on.", "quotes": [{"id": 800313201, "item_id": 50019575, "url": "https://news.ycombinator.com/item?id=50019575", "by": "gandreani", "date": "2026-10-09", "stance": "neutral", "quote": "I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace", "excerpt": "I agree! I can't comment on the design of the SDKs but from the looks of it this is a great option to integrate into agent harnesses/pipelines. The \"audit\" and \"debug\" mode are specially useful. I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace to figure out all the harnesses dependencies.", "context": "", "use_case": "sandboxing agent harnesses", "switched_from": "", "story": "MXC - a sandboxed code execution system"}, {"id": 800563712, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "most things that I run that aren't from my distro's repos get their own bubblewrap", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "sandboxing apps", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 782898547, "item_id": 48931159, "url": "https://news.ycombinator.com/item?id=48931159", "by": "subscribed", "date": "2026-07-15", "stance": "neutral", "quote": "running it in the bwrap (pain in the ass in itself)", "excerpt": "Not my experience. I use Claude to build me a small web app I needed for ages, I'm using its superpowers to discuss/talk about architecture /brainstorm/build plans, and always a fresh context with the built plans. A few times the plan implementer (subagent writing a code assigned to the task) found something lacking (more often it was test issue related to the code, not the actual flaw of the implementation plan), fi", "context": "", "use_case": "sandboxing agent", "switched_from": "", "story": "Microsoft Patches a Record 570 Security Flaws"}]}, {"label": "Shared kernel", "summary": "One commenter warns that, unlike a hypervisor, it shares the host kernel, leaving an attacker one exploit away from root.", "quotes": [{"id": 788935363, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "warn", "quote": "Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Firefox is now the last major browser that still supports uBlock Origin"}]}, {"label": "Developer-oriented", "summary": "Few ready-made scripts exist for applications, so one commenter suggests ordinary users stick with Flatpak.", "quotes": [{"id": 733863680, "item_id": 45866480, "url": "https://news.ycombinator.com/item?id=45866480", "by": "aborsy", "date": "2025-11-09", "stance": "recommend", "quote": "I experimented bubblewrap as a better alternative to firejail.", "excerpt": "I experimented bubblewrap as a better alternative to firejail. Unfortunately there are scripts for few applications. It\u2019s tool for developers. Users are better off flatpaks powered by bubblewrap .", "context": "", "use_case": "application sandboxing", "switched_from": "firejail", "story": "Using bubblewrap to add sandboxing to NetBSD"}]}, {"label": "Limited policy control", "summary": "Some found alternatives like Leash or Landlock easier for strict network and process policies.", "quotes": [{"id": 750038113, "item_id": 46877382, "url": "https://news.ycombinator.com/item?id=46877382", "by": "bigwheels", "date": "2026-02-03", "stance": "compare", "quote": "Way better than bubblewrap imo.", "excerpt": "I use Leash [1] [2] for sandboxing my agents (to great effect!). I've been very happy with it, it provides much strict policy-level control for both process-level + network-level activity, as well as full visibility with a nice UI and dynamic runtime controls via WebUI. Way better than bubblewrap imo. I originally saw it here on HN and have been hooked ever since. [1] Screenshot: https://camo.githubusercontent.com/99", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Sandboxing AI Agents in Linux"}, {"id": 737531793, "item_id": 46095737, "url": "https://news.ycombinator.com/item?id=46095737", "by": "adeon", "date": "2025-11-30", "stance": "compare", "quote": "alternatives to bubblewrap because I couldn't figure out how to do the same thing in bwrap conveniently", "excerpt": "I've used Landlock to detect and stop unwanted telemetry. I wrote some C that stopped networking except to accept connections on a single port, no outgoing connections and no accepting connections on any other port. `dmesg` shows the connections it blocks (I think this is maybe the audit feature). I used an example sandboxer.c as a base (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/la", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Landlock-Ing Linux"}]}], "who": [{"by": "mikemcquaid", "context": "Homebrew maintainer", "url": "https://news.ycombinator.com/item?id=49683889", "date": "2026-09-13"}, {"by": "Eueudhsbsj32", "context": "Linux laptop user", "url": "https://news.ycombinator.com/item?id=49365407", "date": "2026-08-19"}, {"by": "himata4113", "context": "Linux user", "url": "https://news.ycombinator.com/item?id=47582652", "date": "2026-03-30"}], "tags": ["for AI coding agents", "for Linux users", "no root needed", "for developers"], "use_cases": ["sandboxing", "sandboxing coding agents", "sandboxing agents", "sandboxing ai agents", "sandboxing agent", "sandboxing lsp servers"], "compared": [{"slug": "docker", "name": "Docker", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "firejail", "name": "Firejail", "co": 2, "switched_from": 1, "switched_to": 0}, {"slug": "landlock", "name": "Landlock", "co": 2, "switched_from": 0, "switched_to": 1}, {"slug": "podman", "name": "Podman", "co": 1, "switched_from": 1, "switched_to": 0}, {"slug": "flatpak", "name": "Flatpak", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "claude-code", "name": "Claude Code", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "pi", "name": "Pi", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "gpt-5", "name": "GPT-5", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49239021", "title": "Auto mode is now the default in Claude Code", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46874139", "title": "Sandboxing AI Agents in Linux", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=45865327", "title": "Using bubblewrap to add sandboxing to NetBSD", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50198675", "title": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50029123", "title": "Telegram Desktop vulnerability allowed any user's file to be stolen", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50016489", "title": "MXC - a sandboxed code execution system", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 3, "compare": 1}, "2025-12": {"recommend": 1}, "2026-01": {"recommend": 1}, "2026-02": {"recommend": 3, "compare": 1}, "2026-03": {"neutral": 1, "recommend": 1}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {"recommend": 3, "neutral": 1}, "2026-07": {"recommend": 4, "neutral": 2}, "2026-08": {"neutral": 1, "recommend": 3, "warn": 1}, "2026-09": {"neutral": 2}, "2026-10": {"neutral": 3, "recommend": 2}}, "quotes": [{"id": 803243634, "item_id": 50202727, "url": "https://news.ycombinator.com/item?id=50202727", "by": "westurner", "date": "2026-10-22", "stance": "neutral", "quote": "To sandbox LSP servers in sphinxdocrs with bwrap in rootless containers", "excerpt": "Can MXC JSON be used for configuration of OS-portable sandboxing policies with OpenShell, too? \"feat(ai-sandbox): accept MXC policy JSON for protected execution \u00b7 westurner/sandbox@7538c33\" https://github.com/westurner/sandbox/commit/7538c3386af8cb6216caaaea457981b69704ad0c \"bwrap: Add the option to skip the procfs mount \u00b7 Pull Request #1508 \u00b7 microsoft/mxc\" https://github.com/microsoft/mxc/pull/1508 \"Manage Sandboxe", "context": "", "use_case": "sandboxing LSP servers", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 800563712, "item_id": 50035232, "url": "https://news.ycombinator.com/item?id=50035232", "by": "zargon", "date": "2026-10-10", "stance": "recommend", "quote": "most things that I run that aren't from my distro's repos get their own bubblewrap", "excerpt": "These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.", "context": "", "use_case": "sandboxing apps", "switched_from": "", "story": "Telegram Desktop vulnerability allowed any user's file to be stolen"}, {"id": 800313201, "item_id": 50019575, "url": "https://news.ycombinator.com/item?id=50019575", "by": "gandreani", "date": "2026-10-09", "stance": "neutral", "quote": "I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace", "excerpt": "I agree! I can't comment on the design of the SDKs but from the looks of it this is a great option to integrate into agent harnesses/pipelines. The \"audit\" and \"debug\" mode are specially useful. I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace to figure out all the harnesses dependencies.", "context": "", "use_case": "sandboxing agent harnesses", "switched_from": "", "story": "MXC - a sandboxed code execution system"}, {"id": 799567488, "item_id": 49972968, "url": "https://news.ycombinator.com/item?id=49972968", "by": "johnsmith1840", "date": "2026-10-06", "stance": "recommend", "quote": "Bubblewrap is a good tech to check out and likely a better tool if you're looking for a simpler option.", "excerpt": "For my assumed goal of yours I would say none of these are good options. A simple VM or ec2 node hosting a coding sandbox is likely the better option. All 3 of these are vastly different tech. Confusingly, you could run all 3 of these at the same time. I know that probally doesn't help. If you want to learn more I'd go get a linux machine somewhere like aws and play around with them. A local agent harness is a \"light", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Linux containers in 500 lines of code (2016)"}, {"id": 798894082, "item_id": 49930880, "url": "https://news.ycombinator.com/item?id=49930880", "by": "lionkor", "date": "2026-10-02", "stance": "neutral", "quote": "a slop cannon wrapper around `bubblewrap`", "excerpt": "My $0.02; I use pi every day, it's always running somewhere for various kinds of tasks (no vibe coding). I run it in `sbh`, a slop cannon wrapper around `bubblewrap` that ensures that the agent only has access to things it could possibly need. The code is short and you can audit it yourself. I run it like `sbh --net pi` or `sbh --net --docker pi` depending if I want the agent to have docker access. The result is that", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Pi 1.0"}, {"id": 796839985, "item_id": 49802499, "url": "https://news.ycombinator.com/item?id=49802499", "by": "saghm", "date": "2026-09-22", "stance": "neutral", "quote": "I approached it by trying to figure out how to build up a bubblewrap based on a config", "excerpt": "This is super interesting to me. I've slowly been working on something similar (https://gitlab.com/saghm/tartarus) because my ideal sandboxing is \"prevent writing to anything outside this dir but still allow reading to most things so that I don't have to manually copy things into a container/VM\". I approached it by trying to figure out how to build up a bubblewrap based on a config that gave the properties I wanted, ", "context": "", "use_case": "sandbox building block", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}, {"id": 794942224, "item_id": 49683889, "url": "https://news.ycombinator.com/item?id=49683889", "by": "mikemcquaid", "date": "2026-09-13", "stance": "neutral", "quote": "Were using Bubblewrap on Linux and moved to Landlock this release.", "excerpt": "Yup! We\u2019ve been using it for a really long time at this point. Were using Bubblewrap on Linux and moved to Landlock this release. P.S. HUGE fan of your blog and writing Simon, keep up the great work. It\u2019s the #1 resource I recommend to anyone in the industry wanting to learn more about LLMs (and pelicans).", "context": "Homebrew maintainer", "use_case": "sandboxing Homebrew on Linux", "switched_from": "", "story": "Homebrew 7.0.0"}, {"id": 791610944, "item_id": 49475684, "url": "https://news.ycombinator.com/item?id=49475684", "by": "regexorcist", "date": "2026-08-28", "stance": "recommend", "quote": "I use bubblewrap directly", "excerpt": "I use bubblewrap directly, never liked Flatpak.", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Sovereign Tech Agency invests \u20ac500k in Flatpak"}, {"id": 789846512, "item_id": 49365407, "url": "https://news.ycombinator.com/item?id=49365407", "by": "Eueudhsbsj32", "date": "2026-08-19", "stance": "recommend", "quote": "I use bubblewrap sandboxes with their own encrypted filesystems and granular permissions for each of my projects.", "excerpt": "On my Linux laptop, I use bubblewrap sandboxes with their own encrypted filesystems and granular permissions for each of my projects. Very easy and secure with NixOS, surely better than what I could do with an Android device.", "context": "Linux laptop user", "use_case": "sandboxing projects", "switched_from": "", "story": "GrapheneOS in 2027 available on high-end Motorola phones"}, {"id": 788935363, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "warn", "quote": "Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Firefox is now the last major browser that still supports uBlock Origin"}, {"id": 787873920, "item_id": 49242120, "url": "https://news.ycombinator.com/item?id=49242120", "by": "frumiousirc", "date": "2026-08-10", "stance": "recommend", "quote": "I use bubblewrap, which I believe claude code also has internally", "excerpt": "I use bubblewrap, which I believe claude code also has internally but not for its `Bash()` tool. I wrap bubblewrap in a script that supports config files to allow different \"profiles\" of use (analogous to eg firefox profiles). The bwrap starts with the whole filesystem mounted read-only, then mounts the current directory read-write and then applies further bind mounts for devices, special case other read-write (eg, ~", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 787831073, "item_id": 49239442, "url": "https://news.ycombinator.com/item?id=49239442", "by": "SwellJoe", "date": "2026-08-09", "stance": "neutral", "quote": "I made a tool to bubblewrap any agent", "excerpt": "I made a tool to bubblewrap any agent (well, any agent I've used more than once), so I can run them in whatever YOLO mode they have with a pretty reasonable level of safety (it protects the rest of the system against prompt injections and supply chain attacks, it can and doesn't try to protect the project being worked on from either). https://github.com/swelljoe/flar", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 783959040, "item_id": 48997440, "url": "https://news.ycombinator.com/item?id=48997440", "by": "jboss10", "date": "2026-07-21", "stance": "recommend", "quote": "I've written an alias for bwrap which only gives the agent access to the cir dir.", "excerpt": "I use this setup aswel. I've written an alias for bwrap which only gives the agent access to the cir dir. Have you managed to setup any firewall or protection for the API keys?", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Stop Using OpenCode"}, {"id": 782898547, "item_id": 48931159, "url": "https://news.ycombinator.com/item?id=48931159", "by": "subscribed", "date": "2026-07-15", "stance": "neutral", "quote": "running it in the bwrap (pain in the ass in itself)", "excerpt": "Not my experience. I use Claude to build me a small web app I needed for ages, I'm using its superpowers to discuss/talk about architecture /brainstorm/build plans, and always a fresh context with the built plans. A few times the plan implementer (subagent writing a code assigned to the task) found something lacking (more often it was test issue related to the code, not the actual flaw of the implementation plan), fi", "context": "", "use_case": "sandboxing agent", "switched_from": "", "story": "Microsoft Patches a Record 570 Security Flaws"}, {"id": 782682577, "item_id": 48917661, "url": "https://news.ycombinator.com/item?id=48917661", "by": "lionkor", "date": "2026-07-15", "stance": "recommend", "quote": "it's a wrapper around bubblewrap, which works quite well.", "excerpt": "I use sandbox-here for this reason, it's a wrapper around bubblewrap, which works quite well. Copy the code and adjust it to your liking: https://github.com/lionkor/sbh I have a shell alias for it, and use it like sbh --net pi for example or sbh --net codex and maybe add --docker if I expect it to do docker things. This kind of wrapper is much easier to handle and maintain than a completely separate tool for sandboxi", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "I tricked Claude into leaking your deepest, darkest secrets"}, {"id": 782548752, "item_id": 48909297, "url": "https://news.ycombinator.com/item?id=48909297", "by": "motoroco", "date": "2026-07-14", "stance": "recommend", "quote": "Check out bubblewrap if you haven\u2019t already. It\u2019s made by Google specifically for wrapping PWAs for the Play Store.", "excerpt": "Yeah, Apple has a rule against simple wrappers. Check out bubblewrap if you haven\u2019t already. It\u2019s made by Google specifically for wrapping PWAs for the Play Store. There\u2019s a tiny bit of work to make a keystore and manifest file, otherwise it just pulls from your PWA config automatically", "context": "", "use_case": "wrapping PWAs for Play Store", "switched_from": "", "story": "Your 'App' Could Have Been a Webpage (so I fixed it for you)"}, {"id": 782462176, "item_id": 48903886, "url": "https://news.ycombinator.com/item?id=48903886", "by": "SwellJoe", "date": "2026-07-14", "stance": "recommend", "quote": "for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity.", "excerpt": "I used lxc many years ago and used to support it in my company's products, but for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity. Any full container or VM thing is much heavier than a namespace with some bind mounts, which is what bubblewrap does. I started out implementing it with podnan, but that's also far too heavy and complicated, as you need to equip", "context": "", "use_case": "sandboxing coding agents", "switched_from": "Podman", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 782330465, "item_id": 48895654, "url": "https://news.ycombinator.com/item?id=48895654", "by": "SwellJoe", "date": "2026-07-13", "stance": "neutral", "quote": "It uses bubblewrap to instantly construct a container around just the agent config, auth and history and the project path.", "excerpt": "I made a tool to solve this problem (at least on Linux, though I believe there's a way to achieve something similar on MacOS): https://github.com/swelljoe/flar It uses bubblewrap to instantly construct a container around just the agent config, auth and history and the project path. The agent or any command it runs can't reach outside of it even if you tell it to (or, more dangerously, a random prompt injection from t", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Grok CLI uploaded the whole home directory to GCS"}, {"id": 782060640, "item_id": 48878790, "url": "https://news.ycombinator.com/item?id=48878790", "by": "phaseleza", "date": "2026-07-11", "stance": "recommend", "quote": "I use bubblewrap to unshare all namespaces (net, pid, ipc, user)", "excerpt": "I use bubblewrap to unshare all namespaces (net, pid, ipc, user) and ro-bind necessary system paths like /etc, /lib, create a tmpfs home, mount the project folder under it (writable), then mount tmpfs over sensitive directories inside the project to hide them. For the network part, a daemon outside the sandbox serves a filtering HTTP proxy on a Unix socket. I mount the Unix socket into the sandbox and bridge it to lo", "context": "", "use_case": "sandboxing coding tools", "switched_from": "", "story": "What xAI's Grok Build CLI Actually Sends to xAI"}, {"id": 778668481, "item_id": 48666780, "url": "https://news.ycombinator.com/item?id=48666780", "by": "gandreani", "date": "2026-06-24", "stance": "recommend", "quote": "I run it sandboxed with https://github.com/containers/bubblewrap", "excerpt": "I use both the openai subscription and the opencode go subscription. I use the go subscription for my personal work and the openai subscription for my consulting work. The differences between the models are minimal, but I usually stick with gpt-5.4-mini, gpt-5.4, mimo-pro-2.5, deepseek-v4-pro. These latter ones have way more usage than even using 5.4-mini so I tend to use them in personal projects for that reason. My", "context": "", "use_case": "sandboxing the harness", "switched_from": "", "story": "GLM-5.2 is the step change for open agents"}, {"id": 776708803, "item_id": 48544300, "url": "https://news.ycombinator.com/item?id=48544300", "by": "Lwerewolf", "date": "2026-06-15", "stance": "neutral", "quote": "behind a pretty restrictive bwrap setup", "excerpt": "mbp16 m5 max 128gb, antirez/ds4, deepseekv4-flash. Works well for relatively dense (let's say <20k LoC per project) C codebases that are essentially a bunch of custom specialized stores, http servers, network infra, media transformers, etc. Runs through Pi with a custom prompt (basically \"don't speculate blindly, isolate things, make them traceable and measurable, then verify\") and behind a pretty restrictive bwrap s", "context": "", "use_case": "sandboxing agent", "switched_from": "", "story": "Ask HN: Has anyone replaced Claude/GPT with a local model for daily coding?"}, {"id": 775509489, "item_id": 48469343, "url": "https://news.ycombinator.com/item?id=48469343", "by": "coppsilgold", "date": "2026-06-09", "stance": "recommend", "quote": "you can unshare and pivot_root into the respective rootfs (using bubblewrap)", "excerpt": "Alpine is a good system for the boot/main rootfs because it's rock solid and has the most recent kernel. When glibc is required or when you just want to access the repositories of other distros you can unshare and pivot_root into the respective rootfs (using bubblewrap). There is also flatpak (uses bubblewrap internally). You can also go the extra mile and use bubblewrap to initialize the desired mount environment an", "context": "", "use_case": "sandboxing and rootfs switching", "switched_from": "", "story": "Alpine Linux 3.24.0 Released"}, {"id": 774776208, "item_id": 48423513, "url": "https://news.ycombinator.com/item?id=48423513", "by": "sshine", "date": "2026-06-06", "stance": "recommend", "quote": "I use bubblewrap inside Ubuntu inside WSL.", "excerpt": "I use bubblewrap inside Ubuntu inside WSL. https://github.com/nix-tools/bubblebox", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Azure Linux Desktop"}, {"id": 762627266, "item_id": 47664204, "url": "https://news.ycombinator.com/item?id=47664204", "by": "benswerd", "date": "2026-04-06", "stance": "recommend", "quote": "You can handroll a lot with:", "excerpt": "Self hosting can be doable for constant small/medium size workloads You can handroll a lot with: https://github.com/nestybox/sysbox?tab=readme-ov-file https://gvisor.dev https://github.com/containers/bubblewrap?tab=readme-ov-file For hardware virtualized machines it much harder but you can do it via: https://github.com/firecracker-microvm/firecracker/ https://github.com/cloud-hypervisor/cloud-hypervisor Freestyle/oth", "context": "", "use_case": "self-hosted sandboxes", "switched_from": "", "story": "Launch HN: Freestyle: Sandboxes for AI Coding Agents"}, {"id": 761322432, "item_id": 47582652, "url": "https://news.ycombinator.com/item?id=47582652", "by": "himata4113", "date": "2026-03-30", "stance": "recommend", "quote": "I recommend everyone to use bwrap if you're on linux and alias all package managers", "excerpt": "I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW", "context": "Linux user", "use_case": "sandboxing package managers", "switched_from": "", "story": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan"}, {"id": 761232418, "item_id": 47577026, "url": "https://news.ycombinator.com/item?id=47577026", "by": "bastard_op", "date": "2026-03-30", "stance": "neutral", "quote": "I use claude-code in an srt or bwrap direct sandbox", "excerpt": "I have a similar issue, where normally I use claude-code in an srt or bwrap direct sandbox, but when I don't, claude-code will call gh _every_ time I backspace out of a /command or escape a menu such a /mcp, any time I paste something, as well as on some timer that sounds like the issue owner's complaint of 10 minutes. I know because I use keepassxc as my secret provider, so I get an approval prompt to allow or deny ", "context": "", "use_case": "sandboxing Claude Code", "switched_from": "", "story": "Claude Code runs Git reset \u2013hard origin/main against project repo every 10 mins"}, {"id": 754493155, "item_id": 47155822, "url": "https://news.ycombinator.com/item?id=47155822", "by": "downsplat", "date": "2026-02-25", "stance": "recommend", "quote": "I use a bubblewrap wrapper to make sure it can't read $HOME or access my ssh keys.", "excerpt": "I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it c", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Sandboxes won't save you from OpenClaw"}, {"id": 754138192, "item_id": 47133637, "url": "https://news.ycombinator.com/item?id=47133637", "by": "l332mn", "date": "2026-02-23", "stance": "recommend", "quote": "I use bubblewrap to sandbox the agent to my projects folder", "excerpt": "I use bubblewrap to sandbox the agent to my projects folder, where the ai gets free read/write reign. Non-synthetic env cars are symlinked into my projects folder from outside that folder.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 750038113, "item_id": 46877382, "url": "https://news.ycombinator.com/item?id=46877382", "by": "bigwheels", "date": "2026-02-03", "stance": "compare", "quote": "Way better than bubblewrap imo.", "excerpt": "I use Leash [1] [2] for sandboxing my agents (to great effect!). I've been very happy with it, it provides much strict policy-level control for both process-level + network-level activity, as well as full visibility with a nice UI and dynamic runtime controls via WebUI. Way better than bubblewrap imo. I originally saw it here on HN and have been hooked ever since. [1] Screenshot: https://camo.githubusercontent.com/99", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Sandboxing AI Agents in Linux"}, {"id": 750034352, "item_id": 46877147, "url": "https://news.ycombinator.com/item?id=46877147", "by": "senko", "date": "2026-02-03", "stance": "recommend", "quote": "bubblewrap (the same thing I used here) on Linux", "excerpt": "There's https://code.claude.com/docs/en/sandboxing that uses something called Seatbelt on Mac and bubblewrap (the same thing I used here) on Linux. No idea how customizable that is.", "context": "", "use_case": "sandboxing AI agents on Linux", "switched_from": "", "story": "Sandboxing AI Agents in Linux"}, {"id": 746050944, "item_id": 46628184, "url": "https://news.ycombinator.com/item?id=46628184", "by": "flakes", "date": "2026-01-14", "stance": "recommend", "quote": "I find it better to bubblewrap against a full sandbox directory.", "excerpt": "I find it better to bubblewrap against a full sandbox directory. Using docker, you can export an image to a single tarball archive, flattening all layers. I use a compatible base image for my kernel/distro, and unpack the image archive into a directory. With the unpack directory, you can now limit the host paths you expose, avoiding leaking in details from your host machine into the sandbox. bwrap --ro-bind image/ / ", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}, {"id": 742518273, "item_id": 46407392, "url": "https://news.ycombinator.com/item?id=46407392", "by": "throwayaw84330", "date": "2025-12-27", "stance": "recommend", "quote": "bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster)", "excerpt": "I use https://github.com/longregen/claude-sandbox It uses bubblewrap (no root needed) and only exposes ~/.cache stuff and the current folder (no git credentials, no ssh credentials, and as few permissions as it's feasible). bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster), but has the same underlying mechanisms for security (cgroups)", "context": "", "use_case": "sandboxing without root", "switched_from": "", "story": "Ask HN: How are you sandboxing coding agents?"}, {"id": 737531793, "item_id": 46095737, "url": "https://news.ycombinator.com/item?id=46095737", "by": "adeon", "date": "2025-11-30", "stance": "compare", "quote": "alternatives to bubblewrap because I couldn't figure out how to do the same thing in bwrap conveniently", "excerpt": "I've used Landlock to detect and stop unwanted telemetry. I wrote some C that stopped networking except to accept connections on a single port, no outgoing connections and no accepting connections on any other port. `dmesg` shows the connections it blocks (I think this is maybe the audit feature). I used an example sandboxer.c as a base (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/la", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Landlock-Ing Linux"}, {"id": 736684032, "item_id": 46042752, "url": "https://news.ycombinator.com/item?id=46042752", "by": "codedokode", "date": "2025-11-24", "stance": "recommend", "quote": "I am using bwrap - it allows blocking network, creating a new process namespace", "excerpt": "I am using bwrap - it allows blocking network, creating a new process namespace (so that sandboxed program cannot mess with host processes) and creating a new filesystem, where you can mount host directories. I only pass through minimal set of directories like /usr and /lib, and only selected files from /etc, as they can contain valuable information. I also pass through several device files like /dev/null, but not th", "context": "", "use_case": "sandboxing untrusted apps", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}, {"id": 733875568, "item_id": 45867223, "url": "https://news.ycombinator.com/item?id=45867223", "by": "qwertox", "date": "2025-11-09", "stance": "recommend", "quote": "I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system.", "excerpt": "Bubblewrap is a really interesting project, really worth checking out. https://github.com/containers/bubblewrap It's the base for Flatpack, the thing that makes Flatpack be sandboxed. I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system. You can bind directories into it, or overlay them into it, restrict other kinds of access. If Docker is a thing in a scale", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Using bubblewrap to add sandboxing to NetBSD"}, {"id": 733863680, "item_id": 45866480, "url": "https://news.ycombinator.com/item?id=45866480", "by": "aborsy", "date": "2025-11-09", "stance": "recommend", "quote": "I experimented bubblewrap as a better alternative to firejail.", "excerpt": "I experimented bubblewrap as a better alternative to firejail. Unfortunately there are scripts for few applications. It\u2019s tool for developers. Users are better off flatpaks powered by bubblewrap .", "context": "", "use_case": "application sandboxing", "switched_from": "firejail", "story": "Using bubblewrap to add sandboxing to NetBSD"}]}