Bubblewrap
A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get Bubblewrap
Package managers
- Homebrew
brew install bubblewrap
About Bubblewrap
Bubblewrap, run as the bwrap command, builds a sandbox around a program on Linux without needing root privileges. You choose which parts of the filesystem are bind-mounted into the sandbox and how networking is set up, then the program runs inside that restricted view.
It is the sandboxing layer underneath Flatpak and similar projects, and it can also be used directly from scripts to confine individual applications. It is a low-level building block, so each sandbox has to be described with command-line options rather than ready-made profiles.
Strengths
- Sandboxes programs without root privileges
- Proven in production as the basis of Flatpak
- Fine-grained control over mounts and networking
- Small C codebase
Limitations
- Linux only
- Low-level; every sandbox must be configured by hand
- No graphical interface or preset profiles
Details
- Pricing
- FreeFree and open source.
- License
- LGPL-2.0-or-later
- Developer
- The Bubblewrap contributors
- Platforms
- Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Linux users and packagers who want to confine programs from scripts
- Categories
- CLI tools, Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to Bubblewrap
Compare allSoftware that can replace Bubblewrap for an important use case, and what changes if you switch.
Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.
Firejail sandboxes existing Linux applications with namespaces and seccomp-bpf and ships preset profiles, but it runs as a SUID program, which some users consider a risk.
gVisor
An application kernel that sandboxes containers to isolate them from the host Linux kernel.
gVisor isolates containers behind its own application kernel through the runsc runtime for Docker and Kubernetes, giving stronger isolation, though some applications may not be compatible.
Sandboxie-Plus
Runs a Windows program inside an isolated box, so whatever it writes to disk or the registry disappears afterwards.
Sandboxie-Plus is a graphical sandbox for Windows rather than Linux, keeping filesystem and registry changes inside discardable boxes instead of scripted command-line sandboxes.
Bubblewrap as an alternative
Listings that name Bubblewrap as an alternative.
AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles.
Bubblewrap runs programs in unprivileged sandboxes on Linux and underlies Flatpak, controlled from scripts rather than per-application profiles.
Similar software
Related functionality, not necessarily a direct replacement.
Flatseal
A graphical utility for reviewing and changing the permissions of installed Flatpak applications.
SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.
Qubes OS
Operating system that compartmentalises work into isolated virtual machines.
Windows Sandbox
A disposable, isolated Windows desktop built into Windows 10 and 11 for running untrusted software.
Kasm Workspaces
Container streaming platform that delivers desktops, applications and isolated browsers to a web browser.
