Bubblewrap

Use it when

• sandbox an untrusted command with a minimal filesystem and no network
• build a restricted Linux execution surface for agent-generated processes

What it solves

Not the fit when

• Linux namespaces are not a virtual machine boundary

Install

apt install bubblewrap

Invoke

bwrap --ro-bind /usr /usr --dev /dev --proc /proc --unshare-net --tmpfs /tmp your-command

Alternatives

No reviewed alternatives recorded yet.