bubblewrap
Unprivileged Linux sandboxing tool using namespaces; the sandbox underneath Flatpak.
HN commenters use it as a lightweight Linux sandbox for AI coding agents12345 and for package managers and other untrusted software,678 with fine-grained control over mounts, namespaces and network access.91011 The most common complaint is tedious, trial-and-error setup,12131415 and one warns that sharing the host kernel leaves it one exploit away from root, unlike a VM.16
Why people recommend it
Sandboxing AI agents · 3
Widely used to confine Claude Code, Codex and other agents to the project directory, hiding SSH keys and $HOME.
“I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system.”
“I use a bubblewrap wrapper to make sure it can't read $HOME or access my ssh keys.”
Show 1 more
“I've written an alias for bwrap which only gives the agent access to the cir dir.”
Fine-grained isolation · 3
Lets users unshare namespaces, bind-mount only needed paths read-only, and cut or proxy network access.
“I use bubblewrap to unshare all namespaces (net, pid, ipc, user)”
“I am using bwrap - it allows blocking network, creating a new process namespace”
Show 1 more
“I find it better to bubblewrap against a full sandbox directory.”
Lightweight · 3
Seen as lighter and faster to launch than Docker, Podman or VMs while still isolating well.
“for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity.”
“bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster)”
Show 1 more
“Bubblewrap is a good tech to check out and likely a better tool if you're looking for a simpler option.”
Easy to script · 3
Commenters wrap it in small scripts, aliases or profile configs to make it convenient to reuse.
“it's a wrapper around bubblewrap, which works quite well.”
“I use bubblewrap, which I believe claude code also has internally”
Show 1 more
Supply-chain protection · 3
Used to wrap npm, pip, cargo and other package managers to limit the blast radius of malicious packages.
“I recommend everyone to use bwrap if you're on linux and alias all package managers”
“most things that I run that aren't from my distro's repos get their own bubblewrap”
Show 1 more
“I made a tool to bubblewrap any agent”
Caveats and dissent
Tedious setup · 3
Configuring it is manual work, often needing rounds of strace to find what a tool depends on.
“I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace”
“most things that I run that aren't from my distro's repos get their own bubblewrap”
Show 1 more
“running it in the bwrap (pain in the ass in itself)”
Shared kernel · 1
One commenter warns that, unlike a hypervisor, it shares the host kernel, leaving an attacker one exploit away from root.
“Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.”
Developer-oriented · 1
Few ready-made scripts exist for applications, so one commenter suggests ordinary users stick with Flatpak.
“I experimented bubblewrap as a better alternative to firejail.”
Limited policy control · 2
Some found alternatives like Leash or Landlock easier for strict network and process policies.
“alternatives to bubblewrap because I couldn't figure out how to do the same thing in bwrap conveniently”
Often compared with
1 moved from Firejail to bubblewrapLandlock2 comments mention both
1 moved from bubblewrap to Landlock
1 moved from Podman to bubblewrap
Who recommends it in their own words
Threads where it came up
- Auto mode is now the default in Claude Code 2 mentions
- Sandboxing AI Agents in Linux 2 mentions
- Using bubblewrap to add sandboxing to NetBSD 2 mentions
- OpenShell – A safe, private runtime for fleets of autonomous AI agents 1 mention
- Telegram Desktop vulnerability allowed any user's file to be stolen 1 mention
- MXC - a sandboxed code execution system 1 mention
Also written as Bubblewrap. Data: bubblewrap.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 36
“To sandbox LSP servers in sphinxdocrs with bwrap in rootless containers”
“most things that I run that aren't from my distro's repos get their own bubblewrap”
“I use bubblewrap and using a new harness with it is usually a couple of rounds of wack-a-mole with strace”
“Bubblewrap is a good tech to check out and likely a better tool if you're looking for a simpler option.”
“a slop cannon wrapper around `bubblewrap`”
“I approached it by trying to figure out how to build up a bubblewrap based on a config”
“Were using Bubblewrap on Linux and moved to Landlock this release.”
“I use bubblewrap directly”
“I use bubblewrap sandboxes with their own encrypted filesystems and granular permissions for each of my projects.”
“Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.”
“I use bubblewrap, which I believe claude code also has internally”
“I made a tool to bubblewrap any agent”
“I've written an alias for bwrap which only gives the agent access to the cir dir.”
“running it in the bwrap (pain in the ass in itself)”
“it's a wrapper around bubblewrap, which works quite well.”
“Check out bubblewrap if you haven’t already. It’s made by Google specifically for wrapping PWAs for the Play Store.”
“for this use case, bubblewrap is the obvious answer. It's exactly the right balance of isolation and simplicity.”
“It uses bubblewrap to instantly construct a container around just the agent config, auth and history and the project path.”
“I use bubblewrap to unshare all namespaces (net, pid, ipc, user)”
“I run it sandboxed with https://github.com/containers/bubblewrap”
“behind a pretty restrictive bwrap setup”
“you can unshare and pivot_root into the respective rootfs (using bubblewrap)”
“I use bubblewrap inside Ubuntu inside WSL.”
“You can handroll a lot with:”
“I recommend everyone to use bwrap if you're on linux and alias all package managers”
“I use claude-code in an srt or bwrap direct sandbox”
“I use a bubblewrap wrapper to make sure it can't read $HOME or access my ssh keys.”
“I use bubblewrap to sandbox the agent to my projects folder”
“Way better than bubblewrap imo.”
“bubblewrap (the same thing I used here) on Linux”
“I find it better to bubblewrap against a full sandbox directory.”
“bubblewrap is a little bit more lightweight than docker (afaiu no overlayfs, launches way faster)”
“alternatives to bubblewrap because I couldn't figure out how to do the same thing in bwrap conveniently”
“I am using bwrap - it allows blocking network, creating a new process namespace”
“I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system.”
“I experimented bubblewrap as a better alternative to firejail.”