bubblewrap
Containers'/%3e%3cdefs%3e%3cpattern%20id='pattern0_1240_293949'%20patternUnits='userSpaceOnUse'%20patternTransform='matrix(11.2%200%200%2011.2%203.93617%200)'%20preserveAspectRatio='none'%20viewBox='0%200%2016%2016'%20width='1'%20height='1'%3e%3cg%20id='pattern0_1240_293949_inner'%3e%3crect%20width='16'%20height='16'%20fill='%23f88376'%20mask='url(%23hatch_gaps)'/%3e%3cmask%20id='hatch_gaps'%20maskUnits='userSpaceOnUse'%20x='0'%20y='0'%20width='16'%20height='16'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3crect%20x='6'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='6'%20y='8'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='4'%20y='2'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='4'%20y='10'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='2'%20y='4'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='2'%20y='12'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20y='6'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20y='14'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='14'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='14'%20y='8'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='12'%20y='2'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='12'%20y='10'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='10'%20y='4'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='10'%20y='12'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='8'%20y='6'%20width='2'%20height='2'%20fill='black'/%3e%3crect%20x='8'%20y='14'%20width='2'%20height='2'%20fill='black'/%3e%3c/mask%3e%3c/g%3e%3c/pattern%3e%3c/defs%3e%3c/svg%3e)
bubblewrap (bwrap) is a small Linux tool that lets unprivileged users build sandboxes from kernel user namespaces. Each sandbox starts from an empty mount namespace on a tmpfs hidden from the host, with optional PID, IPC, network and UTS namespaces and seccomp filters. Rather than shipping a security policy of its own, it leaves the policy to whatever calls it, which is how Flatpak and Anthropic's Sandbox Runtime use it. The project lives in the containers GitHub organization.
Openness
5 high confidence- license
- LGPL-2.1(COPYING carries the LGPL 2.1 text
- source
- public(C, builds with meson)
- core features withheld
- no — a single command-line tool with no paid edition, shipped through Linux distribution packages
bubblewrap is free software under the GNU Lesser General Public License: the source files allow version 2 or any later version, and the license text shipped with them is version 2.1. The whole tool builds from the public repository, and there is no company edition, hosted service or withheld feature beside it.
- https://cdn.jsdelivr.net/gh/containers/bubblewrap/ recorded 2026-10-13
The repository tree at v0.13.0 holds bubblewrap.c with its helper C files, meson.build, tests, completions, demos and packaging, COPYING and SECURITY.md; there is no ee/, enterprise/, commercial/ or proprietary/ path.
- https://cdn.jsdelivr.net/gh/containers/bubblewrap/bubblewrap.c recorded 2026-10-13
The main source file opens "Copyright (C) 2016 Alexander Larsson" and "SPDX-License-Identifier: LGPL-2.0-or-later", allowing version 2 of the LGPL or any later version.
- https://cdn.jsdelivr.net/gh/containers/bubblewrap/COPYING recorded 2026-10-13
COPYING at the latest release (v0.13.0) is the "GNU LESSER GENERAL PUBLIC LICENSE", "Version 2.1, February 1999".
- https://cdn.jsdelivr.net/gh/containers/bubblewrap/README.md recorded 2026-10-13
The README says bubblewrap "is available in the package repositories of the most Linux distributions" and gives the meson commands to build it from source; it names Flatpak and rpm-ostree as users and describes no paid edition or hosted service.
Adoption
5 medium confidencebubblewrap reaches people mostly as a dependency that Linux distributions install for Flatpak and similar tools, so no download count captures it. Debian's opt-in popularity survey finds it on nearly half of reporting machines, which puts it among the system's commonly installed components.
- https://cdn.jsdelivr.net/gh/anthropics/sandbox-runtime/README.md recorded 2026-10-13
Anthropic's Sandbox Runtime README says it uses "native OS sandboxing primitives (`sandbox-exec` on macOS, `bubblewrap` on Linux)" and tells Linux users to install bubblewrap from apt, dnf or pacman.
- https://cdn.jsdelivr.net/gh/containers/bubblewrap/README.md recorded 2026-10-13
The README lists Flatpak, rpm-ostree unprivileged and bwrap-oci as users, and says the larger frameworks that build its command lines include Flatpak, libgnome-desktop and sandwine.
- https://img.shields.io/github/stars/containers/bubblewrap.json recorded 2026-10-13
shields.io relay of the GitHub stargazer count for containers/bubblewrap: 9k stars.
- https://qa.debian.org/popcon.php?package=bubblewrap recorded 2026-10-13
Debian popularity contest for bubblewrap: installed on 134,122 of 291,938 reporting systems (45.94%) and used regularly on 113,764.
Capability
3 medium confidencebubblewrap isolates a process with Linux namespaces and optional seccomp filters, a boundary that shares the host kernel, unlike a microVM or gVisor. Its protection depends entirely on the arguments it is given, which places it level with Sandbox Runtime, a ready-made policy layer built on bubblewrap on Linux.
- https://cdn.jsdelivr.net/gh/containers/bubblewrap/README.md recorded 2026-10-13
The README says bubblewrap "is not a complete, ready-made sandbox with a specific security policy" and that protection "is entirely determined by the arguments passed to bubblewrap"; it documents a new mount namespace on an invisible tmpfs, user, IPC, PID, network and UTS namespaces, and seccomp filters.
Verified 2026-10-13