{"id":183160,"date":"2026-08-27T22:53:24","date_gmt":"2026-08-27T20:53:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vypusk-bubblewrap-0-12-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2026-08-27T22:53:29","modified_gmt":"2026-08-27T20:53:29","slug":"bubblewrap-0-12-release-a-layer-for-creating-isolated-environments","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/bubblewrap-0-12-release-a-layer-for-creating-isolated-environments","title":{"rendered":"Bubblewrap 0.12-udgivelse, lag til at skabe isolerede milj\u00f8er","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
En ny version af v\u00e6rkt\u00f8jet til organisering af arbejdet med isolerede milj\u00f8er, Bubblewrap 0.12, er offentliggjort. Bubblewrap anvendes af Flatpak-projektet som et lag til isolation af applikationer, der k\u00f8res fra pakker for at begr\u00e6nse adgang for uprivilegerede brugere. Isolationen bruger traditionelle Linux-teknologier til containervirtualisering baseret p\u00e5 brugen af cgroups, namespaces, Seccomp og SELinux. Projektets kode er skrevet p\u00e5 C og distribueres under LGPLv2.1+-licensen. <\/p>\n
Filsystemisoleringen sker gennem oprettelse af et nyt monteringsnavnrum (mount namespace) som standard, hvorved der oprettes en tom rodpartition ved hj\u00e6lp af tmpfs. I denne partition monteres eksterne filsystempartitioner efter behov i 'mount --bind' tilstand (for eksempel, n\u00e5r du starter med indstillingen 'bwrap --ro-bind \/usr \/usr' g\u00f8res partitionen \/usr tilg\u00e6ngelig fra hovedsystemet i skrivebeskyttet tilstand). Netv\u00e6rksmulighederne begr\u00e6nses til adgang til loopback-gr\u00e6nsefladen med isolering af netv\u00e6rksstakken via flags CLONE_NEWNET og CLONE_NEWUTS. <\/p>\n
For excluding all unnecessary user and process identifiers from the created isolated environment, the CLONE_NEWUSER (user namespace) and CLONE_NEWPID (PID namespace) modes can be used, and to prevent the acquisition of new privileges, the PR_SET_NO_NEW_PRIVS mode is applied. To obtain the necessary privileges, the 'user namespace' is utilized. <\/p>\n
I den nye version: <\/p>\n
\n
Licensen for koden er \u00e6ndret fra LGPL 2.0+ til LGPL 2.1+.\n
Support for building in the form of an executable file that gains additional privileges through the suid root flag has been discontinued. Presence of support for 'user namespace' in the system is now mandatory. The reason cited is the complexity of maintaining the version with the suid flag against the widespread support for 'user namespace' in distributions.\n
An option '-not-a-security-boundary' has been added, which when set, prevents certain failures during the setup of an isolated sandbox environment, such as remounting sub-filesystems, from causing a crash.\n
A build option 'assume_kernel' has been added, which disables backward compatibility with Linux kernels older than the specified version. For example, specifying versions 5.6.0+ will lead to the exclusion of alternative implementations of the 'openat2(RESOLVE_IN_ROOT)' functionality. <\/ul>\n