Alternatives to Bubblewrap

A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Bubblewrap.

  • Firejail

    A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.

    FreeOpen sourceLinuxCommand line

    Firejail sandboxes existing Linux applications with namespaces and seccomp-bpf and ships preset profiles, but it runs as a SUID program, which some users consider a risk.

  • gVisor

    An application kernel that sandboxes containers to isolate them from the host Linux kernel.

    FreeOpen sourceLinuxCommand line

    gVisor isolates containers behind its own application kernel through the runsc runtime for Docker and Kubernetes, giving stronger isolation, though some applications may not be compatible.

  • Sandboxie-Plus

    Runs a Windows program inside an isolated box, so whatever it writes to disk or the registry disappears afterwards.

    FreeOpen sourceWindows

    Sandboxie-Plus is a graphical sandbox for Windows rather than Linux, keeping filesystem and registry changes inside discardable boxes instead of scripted command-line sandboxes.

Also worth comparing

These listings name Bubblewrap as their own alternative, so the relationship runs both ways.

  • AppArmor

    A Linux kernel security module that confines programs to the actions allowed in per-application profiles.

    FreeProprietaryLinuxCommand line

    Bubblewrap runs programs in unprivileged sandboxes on Linux and underlies Flatpak, controlled from scripts rather than per-application profiles.

Similar software

Related functionality, not a direct replacement.