Sandboxing Applications with Bubblewrap: Securing a Basic Shell
Sandboxing Applications with Bubblewrap: Securing a Basic Shell
Everybody knows that allowing different applications unlimited access to each other’s data is not exactly optimal from a security point of view. While servers have enjoyed containers to isolate applications from each other, we lack a good solution for the desktop. Or do we? There is, obviously, flat...
Nice series of blog posts I found detailing how to use bubblewrap (the sandboxing tool used by Flatpak) to sandbox regular programs.
I was setting up a modded minecraft launcher for the family to use and and I have trust issues with the modding ecosystem and kids installing random jar files. I used bwrap and it works really well. The launcher uses wayland, minecraft typically X, needs dri access for opengl, pipewire, input devices, networking and dns resolve to connect to servers etc. Doesn't need filesystem access to much other than some shared libs (ro) and a directory in .config. There is a bit of trial and error involved and making the bwrap robust to differences between desktops (different sockets for dns or mdns resolvers) and makes me appreciate apps packaged as flatpak as this level of sandboxing should be standardised for all distributed apps. Half the stuff in AUR should be bwrapped IMO.
I've been meaning to set up sandboxing, this is super helpful! Thanks
Does anyone happen to know if bubblewrap is more powerful than bubblejail (or vice versa). Or how they differ in the first place (beyond CLI vs GUI)?
bubblejail is based on bubblewrap.