{"slug": "bwrap", "name": "bwrap", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 6, "commenters": 7, "warners": 1, "score": 4.421, "rising": 0.69, "first": "2025-11-28", "latest": "2026-09-22", "why": "Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 6, "neutral": 0, "compare": 0, "warn": 1}, "spark": [1, 0, 0, 1, 2, 0, 0, 0, 0, 0, 2, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself", "kind": "", "icon": false, "domain": null, "github_repo": null, "official_url": "https://github.com/containers/bubblewrap", "pricing": "", "aliases": ["bwrap"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 796928336, "item_id": 49808021, "url": "https://news.ycombinator.com/item?id=49808021", "by": "sieve", "date": "2026-09-22", "stance": "recommend", "quote": "decided to start using bwrap", "excerpt": "I guess people are slowly realizing that giving LLMs r/w access to your entire machine is an utterly insane idea. I did a quick look-around last month and decided to start using bwrap. But manually configuring it on a per-project basis is irritating. So I rolled out something for my own use (+ a couple of friends) based on bwrap. What I do: - start with `bwrap --clearenv --unshare-all --die-with-parent --tmpfs / ...`", "context": "built own bwrap-based wrapper", "use_case": "sandboxing LLM agents", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}, {"id": 796882385, "item_id": 49805149, "url": "https://news.ycombinator.com/item?id=49805149", "by": "XJ6w9dTdM", "date": "2026-09-22", "stance": "recommend", "quote": "Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself", "excerpt": "As everyone mention, there are a lot of implementations of this idea, and not only for agent workflows. My own approach has the following features, hopefully that gets stolen into an actual softawre package at some point: - Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself. I wont't trust a random sandbox. - UDS based automatic HTTP proxy with popup or allowlist and reverse prox", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 779077362, "item_id": 48692335, "url": "https://news.ycombinator.com/item?id=48692335", "by": "coppsilgold", "date": "2026-06-26", "stance": "warn", "quote": "the 'bwrap' alias has this problem: `bash: cannot set terminal process group (1): Not a tty`", "excerpt": "It just didn't seem fully baked yet, the 'do' subcommand works fine while the 'bwrap' alias has this problem: `bash: cannot set terminal process group (1): Not a tty`. When executing 'bash -li'. Also the EROFS feature of 'do' should probably be included in 'bwrap', it can be useful. Include overlay options. Also some things you can do to make gvisor better are Wayland passthrough, vulkan support (or virtio native con", "context": "", "use_case": "", "switched_from": "", "story": "Run isolated sandboxes with full lifecycle control: AWS introduces MicroVMs"}]}], "who": [{"by": "sieve", "context": "built own bwrap-based wrapper", "url": "https://news.ycombinator.com/item?id=49808021", "date": "2026-09-22"}], "tags": [], "use_cases": ["sandboxing", "sandboxing llm agents", "linux sandboxing", "sandboxing processes"], "compared": [{"slug": "firejail", "name": "firejail", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "nix", "name": "Nix", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "gvisor", "name": "gVisor", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "drop", "name": "Drop", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49801329", "title": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48642510", "title": "Run isolated sandboxes with full lifecycle control: AWS introduces MicroVMs", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47582220", "title": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47501729", "title": "LiteLLM Python package compromised by supply-chain attack", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46840179", "title": "Noctia: A sleek and minimal desktop shell thoughtfully crafted for Wayland", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46070203", "title": "GitLab discovers widespread NPM supply chain attack", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 1}, "2026-03": {"recommend": 2}, "2026-04": {}, "2026-05": {}, "2026-06": {"warn": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 2}, "2026-10": {}}, "quotes": [{"id": 796928336, "item_id": 49808021, "url": "https://news.ycombinator.com/item?id=49808021", "by": "sieve", "date": "2026-09-22", "stance": "recommend", "quote": "decided to start using bwrap", "excerpt": "I guess people are slowly realizing that giving LLMs r/w access to your entire machine is an utterly insane idea. I did a quick look-around last month and decided to start using bwrap. But manually configuring it on a per-project basis is irritating. So I rolled out something for my own use (+ a couple of friends) based on bwrap. What I do: - start with `bwrap --clearenv --unshare-all --die-with-parent --tmpfs / ...`", "context": "built own bwrap-based wrapper", "use_case": "sandboxing LLM agents", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}, {"id": 796882385, "item_id": 49805149, "url": "https://news.ycombinator.com/item?id=49805149", "by": "XJ6w9dTdM", "date": "2026-09-22", "stance": "recommend", "quote": "Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself", "excerpt": "As everyone mention, there are a lot of implementations of this idea, and not only for agent workflows. My own approach has the following features, hopefully that gets stolen into an actual softawre package at some point: - Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself. I wont't trust a random sandbox. - UDS based automatic HTTP proxy with popup or allowlist and reverse prox", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}, {"id": 779077362, "item_id": 48692335, "url": "https://news.ycombinator.com/item?id=48692335", "by": "coppsilgold", "date": "2026-06-26", "stance": "warn", "quote": "the 'bwrap' alias has this problem: `bash: cannot set terminal process group (1): Not a tty`", "excerpt": "It just didn't seem fully baked yet, the 'do' subcommand works fine while the 'bwrap' alias has this problem: `bash: cannot set terminal process group (1): Not a tty`. When executing 'bash -li'. Also the EROFS feature of 'do' should probably be included in 'bwrap', it can be useful. Include overlay options. Also some things you can do to make gvisor better are Wayland passthrough, vulkan support (or virtio native con", "context": "", "use_case": "", "switched_from": "", "story": "Run isolated sandboxes with full lifecycle control: AWS introduces MicroVMs"}, {"id": 761337584, "item_id": 47583599, "url": "https://news.ycombinator.com/item?id=47583599", "by": "mixedbit", "date": "2026-03-30", "stance": "recommend", "quote": "", "excerpt": "Check also https://github.com/wrr/drop which is a higher-level tool than bwrap. It allows you to make such isolated sandboxes with minimal configuration.", "context": "", "use_case": "Linux sandboxing", "switched_from": "", "story": "Axios Compromised on NPM \u2013 Malicious Versions Drop Remote Access Trojan"}, {"id": 760196097, "item_id": 47512256, "url": "https://news.ycombinator.com/item?id=47512256", "by": "ashishb", "date": "2026-03-24", "stance": "recommend", "quote": "", "excerpt": "I am happily running all third-party tools inside the Amazing Sandbox[1]. I made it public last year. 1 - https://github.com/ashishb/amazing-sandbox", "context": "", "use_case": "", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 749637427, "item_id": 46852339, "url": "https://news.ycombinator.com/item?id=46852339", "by": "its_ubuntu", "date": "2026-02-01", "stance": "recommend", "quote": "", "excerpt": "I recommend staying far away from x11libre. It's a red herring and nothing good will come out of that project. RedHat/Microsoft (but I repeat myself) is behind it. Study the drama that went on surrounding its launch. All that was meant to give the project street cred, like they're the rebel forces working against Big Brother. Nope, there's red flags all over that situation. Classic example of Controlled Opposition. T", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Noctia: A sleek and minimal desktop shell thoughtfully crafted for Wayland"}, {"id": 737299536, "item_id": 46081221, "url": "https://news.ycombinator.com/item?id=46081221", "by": "kernc", "date": "2025-11-28", "stance": "recommend", "quote": "", "excerpt": "I wrote myself a handy and generalized bwrap-wrapping script: https://github.com/sandbox-utils/sandbox-run", "context": "", "use_case": "Sandboxing processes", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}]}