containers/bubblewrap

View on GitHub

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

Stars: 8.7k
Forks: 386
Open beginner issues: 0
Indexed issues: 152
Avg merge: 3d 17h
Merged PRs (30d): 11

Dominant language: C
License: No license data
Last GitHub push: Sep 14, 2026
Latest indexed: Sep 15, 2026
Contributing guide: No contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted

Open All

152 open issues indexed

Missing examples / tests for --userns2 option Open

containers/bubblewrap#542 · 9 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Allow --uid and --gid without --unshare-user when running as root Open

containers/bubblewrap#551 · 4 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Don't implicily enable --unshare-user when not running as root Open

containers/bubblewrap#552 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Feature request: --json-status-fd could provide pid of command? Open

containers/bubblewrap#553 · 4 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
"--new-session" underadvertised and CVE-2017-5226 still a thing in 2023 by default? Open

containers/bubblewrap#555 · 11 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Default behaviour of `--cap-drop` Open

containers/bubblewrap#561 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
--bind fails if directories above are not +rx Open

containers/bubblewrap#569 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
--bind non-world-x path with --unshare-user Open

containers/bubblewrap#570 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Pass WINCH signal to child process Open

containers/bubblewrap#573 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Build fails on Android using Clang 16 (termux) Open

containers/bubblewrap#579 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
bubblewrap should fall back to MS_MOVE if pivot_root() fails Open

containers/bubblewrap#592 · 10 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
"pivot_root: Invalid argument" when running on a SLURM cluster node from NFS Open

help wanted

containers/bubblewrap#594 · 14 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Overlayfs masking/whiteout layer Open

containers/bubblewrap#601 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
enhancement: --daemonize-with-child option Open

containers/bubblewrap#614 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Is there like a native C Library? Open

enhancement help wanted

containers/bubblewrap#626 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
`--die-with-parent` fails to clean up due to a race condition if the parent bwrap process is killed soon after startup Open

containers/bubblewrap#633 · 1 comment · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Child PID from `--info-fd` and `--json-status-fd` is not concurency safe Open

containers/bubblewrap#634 · 0 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
Static analyzers see opt_args_data as leaked (but the leak is O(1) therefore not a real problem) Open

containers/bubblewrap#639 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add --cgroup flag for mounting cgroups Open

containers/bubblewrap#645 · 2 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
`--bind` can cause bwrap to fail during startup if it races with the mount table changing Open

containers/bubblewrap#650 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
bwrap can exit while overlayfs upper directory is still busy, preventing reuse in a subsequent command Open

containers/bubblewrap#672 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Had to replace symlink with ro-bind to get minimal example to work Open

containers/bubblewrap#686 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
losing mounts on autofs restart Open

containers/bubblewrap#687 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
--die-with-parent is a massive footgun Open

containers/bubblewrap#692 · 1 comment · 2 reactions · 0 assignees · Indexed Sep 15, 2026
locally-written launch script unexpectedly allows sandboxed app to overwrite its own .desktop file Open

containers/bubblewrap#695 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
child bwrap process is left as zombie Open

containers/bubblewrap#697 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Add a `--netns FD` option for preexisting namespaces Open

containers/bubblewrap#698 · 2 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
`PR_SET_PDEATHSIG` is racy unless there is a check for the parent having already died Open

containers/bubblewrap#700 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Have a specific exit code for when sandboxing is not possible Open

containers/bubblewrap#701 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Overlay arguments on DM-Verity / with overlayfs results in userxattr: Invalid argument Open

containers/bubblewrap#702 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Massive bindings that requires more than 9000 args Open

containers/bubblewrap#703 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
SECURITY.md refresh Open

containers/bubblewrap#708 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Consider adding optional pre-configure seccomp filters Open

containers/bubblewrap#710 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add comparison to gVisor and sandbox2 Open

containers/bubblewrap#714 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
--bind-try with empty argument unexpectedly bind-mounts whole filesystem Open

containers/bubblewrap#715 · 7 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Comparison with `unshare` from util-linux Open

containers/bubblewrap#720 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add `--binfmt_misc` for mounting a `binfmt_misc` filesystem Open

containers/bubblewrap#721 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
chanegd permissions after re-creating a char device under /dev Open

containers/bubblewrap#722 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
`--clearenv` leaks environment Open

containers/bubblewrap#725 · 0 comments · 6 reactions · 0 assignees · Indexed Sep 15, 2026
--new-session inhibits bwrap's ability to terminate child process when parent is terminated Open

containers/bubblewrap#726 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
security-context-v1 support Open

containers/bubblewrap#736 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Related project comparisons in README.md are outdated Open

containers/bubblewrap#743 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
bwrap has impact on the shell when finished Open

containers/bubblewrap#744 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
unshare-net fails on gvisor due to failing loopback setup Open

containers/bubblewrap#745 · 2 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
bind mount /proc/<PID>/mountinfo ? Open

containers/bubblewrap#752 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Use "new mount API" if available Open

enhancement help wanted

containers/bubblewrap#755 · 3 comments · 7 reactions · 0 assignees · Indexed Sep 15, 2026
bubblewrap manpage is desynced from source code Open

containers/bubblewrap#767 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] add -create suffix for --bind Open

containers/bubblewrap#768 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Feature Question: Unshare vs Clone Open

containers/bubblewrap#776 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Test suite does not seem to work properly when compiling inside /tmp Open

containers/bubblewrap#781 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026

containers/bubblewrap

Get new issues in your inbox