{"id":183160,"date":"2026-08-27T22:53:24","date_gmt":"2026-08-27T20:53:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vypusk-bubblewrap-0-12-proslojki-dlya-sozdaniya-izolirovannyh-okruzhenij"},"modified":"2026-08-27T22:53:29","modified_gmt":"2026-08-27T20:53:29","slug":"bubblewrap-0-12-release-a-layer-for-creating-isolated-environments","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/bubblewrap-0-12-release-a-layer-for-creating-isolated-environments","title":{"rendered":"L\u00ebshimi i Bubblewrap 0.12, shtresat p\u00ebr krijimin e mjediseve t\u00eb izoluara","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar nj\u00eb version i ri i instrumentit p\u00ebr organizimin e pun\u00ebs n\u00eb mjedise t\u00eb izoluara Bubblewrap 0.12, i p\u00ebrdorur p\u00ebr t\u00eb kufizuar aplikacione t\u00eb ve\u00e7anta t\u00eb p\u00ebrdoruesve pa privilegje. N\u00eb praktik\u00eb, Bubblewrap p\u00ebrdoret nga projekti Flatpak si nj\u00eb nd\u00ebrfaqe p\u00ebr izollimin e aplikacioneve t\u00eb ekzekutuara nga paketat. P\u00ebr izollimin p\u00ebrdoren teknologjit\u00eb tradicionale t\u00eb virtualizimit t\u00eb kontejner\u00ebve p\u00ebr Linux, t\u00eb bazuara n\u00eb p\u00ebrdorimin e cgroups, hap\u00ebsirave t\u00eb emrave (namespaces), Seccomp dhe SELinux. Kodi i projektit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn LGPLv2.1+. <\/p>\n
Izolimi n\u00eb nivelin e sistemit t\u00eb dosjeve b\u00ebhet p\u00ebrmes krijimit t\u00eb default nj\u00eb hap\u00ebsire t\u00eb re em\u00ebrimi p\u00ebr pik\u00ebt e montimit (mount namespace), n\u00eb t\u00eb cilin me ndihm\u00ebn e tmpfs krijohet nj\u00eb ndarje bosh rr\u00ebnjore. N\u00eb k\u00ebt\u00eb ndarje mund t\u00eb lidhen ndarjet e FS-s\u00eb s\u00eb jashtme n\u00eb modin \"mount \u2014bind\" (p.sh., gjat\u00eb ekzekutimit me opsionin \"bwrap \u2014ro-bind \/usr \/usr\" ndarja \/usr kalon nga sistemi kryesor n\u00eb modin vet\u00ebm p\u00ebr lexim). Mund\u00ebsit\u00eb rrjet\u00ebsohen duke kufizuar qasjen n\u00eb nd\u00ebrfaqen loopback me izolimin e grak\u00ebs rrjet t\u00eb p\u00ebrmes flamujve CLONE_NEWNET dhe CLONE_NEWUTS. <\/p>\n
P\u00ebr t\u00eb p\u00ebrjashtuar t\u00eb gjitha identifikuesit e panevojsh\u00ebm t\u00eb p\u00ebrdoruesve dhe proceseve nga ambienti i izoluar q\u00eb krijohet, mund t\u00eb p\u00ebrdoren modet CLONE_NEWUSER (user namespace) dhe CLONE_NEWPID (PID namespace), dhe p\u00ebr t\u00eb ndaluar marrjen e privilegjeve t\u00eb reja, aplikohet moda PR_SET_NO_NEW_PRIVS. P\u00ebr t\u00eb marr\u00eb privilegjet e nevojshme p\u00ebrdoret \"user namespace\". <\/p>\n
Mb\u00ebshtetja p\u00ebr nd\u00ebrtimin e form\u00ebs s\u00eb skedarit ekzekutiv, i cili merr privilegje t\u00eb tjera p\u00ebrmes flamurit suid root, \u00ebsht\u00eb nd\u00ebrprer\u00eb. Prania n\u00eb sistem e mb\u00ebshtetjes \"user namespace\" tani \u00ebsht\u00eb e detyrueshme. Si arsye \u00ebsht\u00eb p\u00ebrmendur puna e zgjatur e mb\u00ebshtetjes p\u00ebr variantin me flamur suid p\u00ebrball\u00eb mb\u00ebshtetjes s\u00eb gjer\u00eb t\u00eb \"user namespace\" n\u00eb shp\u00ebrndarjet.\n
\u00cbsht\u00eb shtuar opsioni \"--not-a-security-boundary\", i cili, kur \u00ebsht\u00eb vendosur, disa d\u00ebshtime gjat\u00eb konfigurimit t\u00eb ambientit t\u00eb izoluar sandbox, si rimontimi i n\u00ebnndarjes, nuk \u00e7ojn\u00eb n\u00eb mbyllje emergjente.\n
\u00cbsht\u00eb shtuar opsioni i nd\u00ebrtimit \"assume_kernel\", i cili \u00e7on n\u00eb \u00e7aktivizimin e siguris\u00eb s\u00eb prapambetjes me kernel\u00ebt Linux q\u00eb jan\u00eb m\u00eb t\u00eb vjet\u00ebr se versioni i caktuar. P\u00ebr shembull, caktimi i versioneve 5.6.0+ do t\u00eb p\u00ebrjashtoj\u00eb zgjidhjen alternative t\u00eb funksionalitetit \"openat2(RESOLVE_IN_ROOT)\". <\/ul>\n