{"id":120438,"date":"2024-10-31T19:09:22","date_gmt":"2024-10-31T17:09:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-bubblewrap-0-11-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2024-10-31T19:09:22","modified_gmt":"2024-10-31T17:09:22","slug":"vypusk-bubblewrap-0-11-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-bubblewrap-0-11-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij","title":{"rendered":"Release of Bubblewrap 0.11, a layer for creating isolated environments","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A new version of the Bubblewrap toolkit for organizing isolated environments, version 0.11, has been released. It is used to limit individual applications of unprivileged users. In practice, Bubblewrap is utilized by the Flatpak project as a layer for isolating applications launched from packages. Traditional Linux container virtualization technologies, based on cgroups, namespaces, Seccomp, and SELinux, are employed for isolation. The project code is written in C and is distributed under the LGPLv2+ license. <\/p>\n
Isolation at the filesystem level is achieved by creating a new mount namespace by default, in which an empty root partition is created using tmpfs. If necessary, external filesystem partitions are attached to this partition in 'mount --bind' mode (for example, when starting with the option 'bwrap --ro-bind \/usr \/usr', the \/usr partition is passed from the main system in read-only mode). Network capabilities are restricted to access to the loopback interface with network stack isolation through the CLONE_NEWNET and CLONE_NEWUTS flags. <\/p>\n
To exclude all unnecessary user and process identifiers from the created isolated environment, the CLONE_NEWUSER (user namespace) and CLONE_NEWPID (PID namespace) modes can be used, and to prevent gaining new privileges, the PR_SET_NO_NEW_PRIVS mode is applied. On systems with 'user namespace', Bubblewrap can run under a regular user, while on systems without 'user namespace', it can use the suid root flag to perform the necessary initialization of the isolated environment. <\/p>\n
In the new release: <\/p>\n
\n
The ability to create mount points has been provided, using the single-layer filesystem OverlayFS, which combines several parts of other filesystems. New command-line options for managing the use of OverlayFS have been introduced: '--overlay', '--tmp-overlay', '--ro-overlay', and '--overlay-src'.\n
An option '--level-prefix' has been added to substitute the priority level in syslog style into diagnostic output, allowing utilities such as 'logger' and 'systemd-cat' to be used for processing the output.\n
Support for the Autotools build system has been discontinued. The Meson toolkit is now required for building. <\/ul>\n