HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
containers
bubblewrap
C2016–2026
containers / bubblewrap

bubblewrap

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

Systems & Infrastructure
Explore on GitHubRead Hacker News discussions
80Distinct people
94Mentions
1Explicit recommenders
9.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

If you want to learn more about container security I recommend https://blog.jessfraz.com/ and https://github.com/projectatomic/bubblewrap

wmf used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:59:53 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year94 dated mentions

Observed mentions: 2016-08-07 13:03:40 UTC to 2026-10-10 15:11:41 UTC.

05101520252016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments20162017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 7 mentions; 1 submissions, 6 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 14 mentions; 1 submissions, 13 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 12 mentions; 1 submissions, 11 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 11 mentions; 1 submissions, 10 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 24 mentions; 0 submissions, 24 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC312
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC303
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC505
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC514
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC716
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC14113
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC12111
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC808
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC11110
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC24024

What Hacker News says

3 sources
ohthehugemanate·Dec 7, 2017
Funny, I never thought about it that way. Namespaced processes being a linux kernel feature in the first place. That's where the whole container thing CAME from in the first place. It's only because the Windows and OSX kernels _don't_ support namespacing, that we have to run docker et al inside a virtual machine on those environments. It is not the container implementation, but the virtual machine, which makes containers "secure" on those platforms. So put more finely: containers are not secure, anywhere. Virtual machines are. So you should run your containers inside virtual machines if security is important to you. Environments that can't run containers natively are forced into the more secure configuration. If you're interested in the ongoing work to make containers more secure, Jessie Frazelle has very clear posts on the subject [1][2
Read the rest
]. The Bubblewrap project also has a great summary of various approaches being used to "jail" container processes properly. [3] [1] https://blog.jessfraz.com/post/containers-zones-jails-vms/ [2] https://blog.jessfraz.com/post/getting-towards-real-sandbox-... [3] https://github.com/projectatomic/bubblewrap
In Kata Containers – The speed of containers, the security of VMs

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.