HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
containers
bubblewrap
C2016–2026
containers / bubblewrap

bubblewrap

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

Systems & Infrastructure
Explore on GitHubRead Hacker News discussions
80Distinct people
94Mentions
1Explicit recommenders
9.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

If you want to learn more about container security I recommend https://blog.jessfraz.com/ and https://github.com/projectatomic/bubblewrap

wmf used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year94 dated mentions

Observed mentions: 2016-08-07 13:03:40 UTC to 2026-10-10 15:11:41 UTC.

05101520252016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments20162017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 7 mentions; 1 submissions, 6 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 14 mentions; 1 submissions, 13 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 12 mentions; 1 submissions, 11 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 11 mentions; 1 submissions, 10 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 24 mentions; 0 submissions, 24 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC312
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC303
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC505
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC514
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC716
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC14113
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC12111
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC808
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC11110
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC24024

What Hacker News says

94 sources
gandreani·Jun 24, 2026
I use both the openai subscription and the opencode go subscription. I use the go subscription for my personal work and the openai subscription for my consulting work. The differences between the models are minimal, but I usually stick with gpt-5.4-mini, gpt-5.4, mimo-pro-2.5, deepseek-v4-pro. These latter ones have way more usage than even using 5.4-mini so I tend to use them in personal projects for that reason. My harness is https://github.com/can1357/oh-my-pi. I trust it...enough. It updates very frequently so as a safe guard I run it sandboxed with https://github.com/containers/bubblewrap so it can only access the project folder and some whitelisted config files
In GLM-5.2 is a step change for open agents
nyrikki·May 18, 2026
Bubblewrap tends to be better at defaults than docker/rancher/podman, where the users rarely use `USER` and/or drop elevated privileges, it still has the same limitations. It is just the reality that namespace/seccomp/ebpf/cgroups are privilege dropping and are not jails. But it is better with common command line options like: $ bwrap --ro-bind /usr /usr --ro-bind /bin /bin --ro-bind /lib /lib --ro-bind /lib64 /lib64 --ro-bind /sbin /sbin --ro-bind /etc /etc --proc /proc --dev /dev --tmpfs /tmp /usr/bin/bash $ grep ^Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 0000000000000000 CapAmb: 0000000000000000 $ grep ^NoNew /proc/$$/status NoNewPrivs: 1 But yes it is using the same clone/unshare/capabilities that containers use. But at least the
Read the rest
y tend to default to running without elevated privileges. Note from the bwrap repo[0] Whatever program constructs the command-line arguments for bubblewrap (often a larger framework like Flatpak, libgnome-desktop, sandwine or an ad-hoc script) is responsible for defining its own security model, and choosing appropriate bubblewrap command-line arguments to implement that security model. Or warnings from distros like arch[1] Warning Bubblewrap is a tool which provides sandboxing technologies like namespaces and seccomp filter. It does not by default provide a full sandbox that isolates weakpoints of a used technology. Running untrusted code is never safe, sandboxing cannot change this. But spin up a bwrap instance like the above and note how just using pythons socket.socket() you can pretty much get every single kernel module in: grep net-pf /lib/modules/`uname -r`/modules.alias That is not in: /etc/modprobe.d/blacklist-rare-network.conf To autoload the kernel modules. That is probably the easiest way to see that you still have the issues with the shared kernel. Note that the LSM like apparmor may add constraints on aa systems look at[2] The bwrap team is better at working the with LSM teams, while OCI actively refuses to give guidance and has a dangerous profile [3] Once again namespaces/cgroups/seccomp/avoiding elevated privlages/etc... are all important for running with minimal privileges, but yes 'sandboxes' and 'containers' provide much less isolation than most people realize. [0] https://github.com/containers/bubblewrap#limitations [1] https://wiki.archlinux.org/title/Bubblewrap [2] https://gitlab.com/apparmor/apparmor/-/blob/master/profiles/... [3] https://gitlab.com/apparmor/apparmor/-/blob/master/profiles/...
In Where OpenClaw Security Is Heading
benswerd·Apr 6, 2026
Self hosting can be doable for constant small/medium size workloads You can handroll a lot with: https://github.com/nestybox/sysbox?tab=readme-ov-file https://gvisor.dev https://github.com/containers/bubblewrap?tab=readme-ov-file For hardware virtualized machines it much harder but you can do it via: https://github.com/firecracker-microvm/firecracker/ https://github.com/cloud-hypervisor/cloud-hypervisor Freestyle/other providers will likely provide better debugging experience but thats something you can probably get past for a lot of workloads. The time when you/anyone should think about Freestyle/anyone is when the load spikes/the need to create hundreds of VMs in short spikes shows up, or when you're looking for some of the more complex feature sets any given provider has built out (forks, GPUs, network boundaries, etc). I also highly r
Read the rest
ecommend self hosting anything you do outside of your normal VPC. Sandboxes are the biggest possible attack surface and it is a feature of us that we're not in your cloud; If we mess up security your app is still fine.
In Launch HN: Freestyle – Sandboxes for Coding Agents
Levitating·Mar 18, 2026
> dislike flatpaks and favor a low-level, bare-metal approach Flatpaks are sandboxed with bubblewrap[1]. I would still call that bare-metal. And flatpaks aren't particularly bloated either, there's no need for a flatpak to be any bigger than a regular binary if it only depends on the kde/gnome/freedesktop runtime. I used to prefer installing apps via my distro directly, but I now prefer using flatpaks because of the way it sandboxes the applications. When I delete a flatpak I know for sure any configuration or cache files for that app are also gone (unless you opt to keep them). If you want to play with atomic distro's, there's a bunch of different approaches out there. For instance GnomeOS is not package based at all. OpenSUSE works via btrfs snapshots, Fedora Atomic uses rpm-ostree currently. [1]: https://github.com/containers/bubblewra
Read the rest
p
In OpenSUSE Kalpa
westurner·Mar 17, 2026
From https://news.ycombinator.com/item?id=47171887 re: [agent] sandboxing : pydantic/monty, vercel-labs/just-bash, amla sandbox, csl-core, microsandbox, workerd, wasmtime-mte containers/bubblewrap: https://github.com/containers/bubblewrap#sandboxing The bubblewrap readme mentions containers as binaries with binctr; I guess without overlayfs or other file-level re-deduplication due to the container fs in the binary. Perhaps similarly, also TIL UKI are easier for UEFI Secure Boot to check signatures on than (kernel, initrd) pairs
In Pyodide: a Python distribution based on WebAssembly
jpeeler·Feb 21, 2026
I've been collecting a list of sandboxing related projects as well, some lower level than others. I wish I had time to evaluate them all: - https://github.com/jingkaihe/matchlock - https://github.com/mishushakov/libkrun-go - https://github.com/earendil-works/gondolin - https://github.com/butter-dot-dev/bvisor - https://github.com/amlalabs/amla-sandbox - https://github.com/eryx-org/eryx - https://github.com/containers/bubblewrap (not new) - https://github.com/coplane/localsandbox - https://github.com/sd2k/conch - https://github.com/Gerharddc/litterbox - https://github.com/finbarr/yolobox - https://github.com/coventry/sandbox-codex - https://github.com/osks/ctenv - https://github.com/tianon/gosu - https://github.com/colony-2/shai - https://github.com/rcarmo/agentbox - https://github.com/coder/httpjail - https://github.com/bytecodealliance/c
Read the rest
omponentize-py - https://github.com/tursodatabase/agentfs - https://github.com/always-further/nono - (another list on HN Deno Sandbox: https://news.ycombinator.com/item?id=46876022) - Did not check if any/all of these are here: https://github.com/arjan/awesome-agent-sandboxes
In macOS's Little-Known Command-Line Sandboxing Tool (2025)

Showing the 15 most recent of 94 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.