bubblewrap
The unprivileged Linux namespace sandboxer behind Flatpak and Anthropic's sandbox runtime; you assemble the policy from command-line flags. The right primitive for a laptop or CI sandbox on Linux when you can write the policy yourself; not a substitute for a VM.
Overview
bubblewrap (bwrap) is an LGPL-2.1 "low-level sandboxing tool for running programs without root privileges" from the containers GitHub organisation, with roots in the xdg-app helper and linux-user-chroot. It starts each run in a new mount namespace with an empty tmpfs root and bind-mounts only the host paths you pass; user namespaces hide every uid and gid except the current one; PID, IPC, network and UTS namespaces can be unshared; seccomp filters can be supplied; and PR_SET_NO_NEW_PRIVS disables setuid binaries. The README is explicit that "bubblewrap is not a complete, ready-made sandbox with a specific security policy" and that "Everything mounted into the sandbox can potentially be used to escalate privileges", so callers are expected to be careful with sockets such as D-Bus. The old setuid mode has been removed; unprivileged user namespaces are required.
bubblewrap is the sandbox under Flatpak, rpm-ostree's unprivileged mode and bwrap-oci, and it is the Linux half of Anthropic's sandbox runtime (anthropic-srt on this site), whose README says it "Uses bubblewrap for containerization with network namespace isolation" while using sandbox-exec on macOS. It is a single binary with no daemon, no API and no persistence; everything is a command-line invocation, which makes it easy to wrap but leaves orchestration, limits and policy to you. bubblewrap 0.13.1 was released on 14 October 2026.
Notable
- Used by Flatpak and by Anthropic's sandbox runtime on Linux
- bubblewrap 0.13.1 released 14 October 2026; LGPL-2.1
- Setuid mode removed; requires unprivileged user namespaces on the host
bubblewrap specifications
| Attribute | Details |
|---|---|
| Isolation | Unprivileged Linux user, mount, PID, network, IPC and UTS namespaces with a tmpfs root, PR_SET_NO_NEW_PRIVS and optional seccomp filters; the caller defines the policy |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (LGPL-2.1) |
| SDKs and interfaces | CLI |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | None; the sandbox starts from an empty tmpfs root that is cleaned up when the last process exits, with host paths bind-mounted as you choose |
| GPU | Not documented |
| Networking | Host network by default; --unshare-net gives a network namespace with loopback only |
| Pricing | Free and open source |
| Free tier | Free to self-host |
| Compliance | Not documented |
| Regions | Not documented |
Facts from bubblewrap’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want a tiny, well-understood tool to confine a coding agent's shell on a Linux machine
- You need unprivileged sandboxing without a daemon, container runtime or hypervisor
- You are building a local agent sandbox and want the same primitive Anthropic uses on Linux
Trade-offs
- Shares the host kernel; it is not a kernel boundary like gVisor or a microVM
- No built-in policy: the README warns that anything you mount in can be an escalation path
- Linux only, and the host must allow unprivileged user namespaces
- No snapshots, resource limits or lifecycle management
Good fit for: Lightweight process sandboxing on Linux where you control the policy and do not need a kernel boundary.
How bubblewrap compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| bubblewrap | Linux namespaces | Yes | Yes / No | Not documented | Not documented | No / No | Not documented | CLI |
| nsjail | Namespaces + seccomp | Yes | Yes / No | Not documented | Configurable | No / No | Not documented | CLI |
| Firejail | Namespaces + seccomp | Yes | Yes / No | Not documented | Not documented | No / No | Not documented | CLI |
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| gVisor | User-space kernel | Yes | Yes / No | ms (claim) | Not documented | Yes / Not documented | Yes | CLI |
| nono | Landlock / Seatbelt | Yes | No / No | Not documented | Not documented | Yes / Not documented | Not documented | CLI, Rust, Python, JavaScript/TypeScript, Go |
Frequently asked questions
What is bubblewrap?
How does bubblewrap isolate code?
Is bubblewrap open source?
How much does bubblewrap cost?
What are the alternatives to bubblewrap?
Sources
Cite this page
Agent Sandboxes. (2026). bubblewrap. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/bubblewrap/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.