{"id":183160,"date":"2026-08-27T22:53:24","date_gmt":"2026-08-27T20:53:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vypusk-bubblewrap-0-12-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2026-08-27T22:53:29","modified_gmt":"2026-08-27T20:53:29","slug":"bubblewrap-0-12-release-a-layer-for-creating-isolated-environments","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/bubblewrap-0-12-release-a-layer-for-creating-isolated-environments","title":{"rendered":"Release of Bubblewrap 0.12, a layer for creating isolated environments","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A new version of the Bubblewrap toolkit 0.12 has been released, which is used to limit individual applications of unprivileged users. In practice, Bubblewrap is used by the Flatpak project as a layer for isolating applications launched from packages. Traditional Linux container virtualization technologies are employed for isolation, based on the use of cgroups, namespaces, Seccomp, and SELinux. The project code is written in C and distributed under the LGPLv2.1+ license. <\/p>\n
Isolation at the filesystem level is achieved by creating a new mount namespace by default, in which an empty root partition is created using tmpfs. If necessary, external filesystem partitions are attached to this partition in 'mount --bind' mode (for example, when starting with the option 'bwrap --ro-bind \/usr \/usr', the \/usr partition is passed from the main system in read-only mode). Network capabilities are restricted to access to the loopback interface with network stack isolation through the CLONE_NEWNET and CLONE_NEWUTS flags. <\/p>\n
To exclude all unnecessary user and process identifiers from the created isolated environment, the modes CLONE_NEWUSER (user namespace) and CLONE_NEWPID (PID namespace) can be used, and to prevent the acquisition of new privileges, the PR_SET_NO_NEW_PRIVS mode is applied. The necessary privileges are obtained using the 'user namespace'. <\/p>\n
In the new release: <\/p>\n
\n
The code license has been changed from LGPL 2.0+ to LGPL 2.1+.\n
Support for building in the form of an executable file that gains additional privileges using the suid root flag has been discontinued. The presence of 'user namespace' support in the system is now mandatory. The reason given is the complexity of maintaining the variant with the suid flag against the widespread support of 'user namespace' in distributions.\n
An option '--not-a-security-boundary' has been added, which, when set, ensures that certain failures when configuring an isolated sandbox environment, such as remounting a subsection, do not lead to an emergency exit.\n
A build option 'assume_kernel' has been added, disabling backward compatibility with Linux kernels older than the specified version. For example, specifying versions 5.6.0+ will exclude the alternative implementation of the 'openat2(RESOLVE_IN_ROOT)' functionality. <\/ul>\n