bubblewrap 命令

常用示例

说明

bubblewrap (bwrap) is an unprivileged sandboxing tool that uses Linux namespaces to create isolated environments. Unlike traditional containers, it can run without root privileges by using user namespaces. The tool creates a new mount namespace with only explicitly specified bindings from the host. This allows fine-grained control over what the sandboxed process can access. It can also isolate network, PID, IPC, and user namespaces. Bubblewrap is used as the foundation for Flatpak's sandboxing and can be used directly for custom application isolation. It focuses on security and minimalism.

参数

--ro-bind _src_ _dest_

Read-only bind mount from src to dest.

--bind _src_ _dest_

Read-write bind mount.

--dev-bind _src_ _dest_

Bind mount with device access.

--tmpfs _dest_

Mount tmpfs at destination.

--proc _dest_

Mount procfs at destination.

--dev _dest_

Create new devtmpfs at destination.

--symlink _src_ _dest_

Create symbolic link.

--unshare-all

Unshare all possible namespaces.

--unshare-user

Create new user namespace.

--unshare-pid

Create new PID namespace.

--unshare-net

Create new network namespace.

--unshare-ipc

Create new IPC namespace.

--uid _uid_

Set user ID in sandbox.

--gid _gid_

Set group ID in sandbox.

--chdir _dir_

Change to directory before running.

--die-with-parent

Kill sandbox when parent exits.

--new-session

Create new terminal session.