Follow this evolving guide for steps and configuration examples to secure a Linux server.
Bubblewrap
Bubblewrap provides low-level, unprivileged sandboxing for Flatpak and similar software projects.
About Bubblewrap
Bubblewrap is a low-level, unprivileged sandboxing tool for Linux, used by Flatpak and similar projects including rpm-ostree unprivileged and bwrap-oci. It relies on Linux user namespaces to let unprivileged users create isolated sandbox environments without root access, and no longer supports the legacy setuid mode for systems without user namespace support. The tool does not ship with a pre-configured security policy; the level of protection between sandboxed processes and the host is fully determined by the command-line arguments passed to it, with the calling framework or script responsible for defining the security model. It uses the PR_SET_NO_NEW_PRIVS kernel feature to block setuid binaries, and its maintainers note it may increase the risk of denial of service attacks from logged-in users.
Key features
- Leverages Linux user namespaces for unprivileged sandbox creation
- Builds sandbox environments via configurable command-line arguments
- Integrates with Flatpak, rpm-ostree unprivileged, and bwrap-oci
- Creates isolated mount namespaces with tmpfs root filesystems
- Blocks setuid binaries using PR_SET_NO_NEW_PRIVS
- Supports bind mounts and proc/dev filesystem mounting for sandboxes
Best for: Unprivileged Linux users and developers building sandboxed application environments, including Flatpak and related project maintainers.
Good for
- Enables unprivileged Linux users to create sandboxes without root access
- Blocks setuid binary escapes via PR_SET_NO_NEW_PRIVS
- Available in package repositories of most major Linux distributions
Watch out for
- Does not include a pre-configured security policy; protection depends on caller arguments
- May increase risk of denial of service attacks from logged-in users
- No longer supports setuid mode for systems without user namespace support
Bubblewrap at a glance
- Category
- Privacy & Security › Desktop & OS Privacy
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Open source
- Not stated
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
Bubblewrap alternatives
Tools and sites you could use instead, ranked by how closely they match.
Use a YubiKey challenge-response at system startup to open a LUKS-encrypted disk volume.
Open source
24 alternatives
Add face-based authentication to Linux using Howdy, which works with built-in infrared emitters and cameras.
Open source
24 alternatives
Hear when a computer sends requests to Google with Googerteller, which provides audible feedback about browsing activity.
Open source
24 alternatives
Configure Ubuntu’s Uncomplicated Firewall through Gufw, a graphical firewall interface.
Open source
24 alternatives
Set USB device authorization rules with USBGuard, a framework for controlling device access.
Open source
24 alternativesPopular in Desktop & OS Privacy
Well-known listings from the same topic.
wBlockapps.apple.com/app/wblock/id6746388723uBO Lite Safariapps.apple.com/app/ublock-origin-lite/id674534…Stayapps.apple.com/app/stay-for-safari/id1591620171Lockdown Privacylockdownprivacy.comTor Browsertorproject.orgFirejailfirejail.wordpress.com
Bubblewrap FAQ
Does Bubblewrap require root privileges to operate?
No, it uses Linux user namespaces to allow unprivileged users to create sandboxes, and its legacy setuid mode has been removed.
Does Bubblewrap include a pre-defined security policy for sandboxes?
No, it is a sandbox construction tool, and the security boundary is fully defined by the arguments passed to it.
Can Bubblewrap be used to escalate privileges on a host system?
Its maintainers state it does not allow privilege escalation when used with typical distribution software, though it may increase denial of service risk from logged-in users.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.