containers/bubblewrap

I use both the openai subscription and the opencode go subscription. I use the go subscription for my personal work and the openai subscription for my consulting work. The differences between the models are minimal, but I usually stick with gpt-5.4-mini, gpt-5.4, mimo-pro-2.5, deepseek-v4-pro. These latter ones have way more usage than even using 5.4-mini so I tend to use them in personal projects for that reason. My harness is https://github.com/can1357/oh-my-pi . I trust it...enough. It updates very frequently so as a safe guard I run it sandboxed with https://github.com/containers/bubblewrap so it can only access the project folder and some whitelisted config files

Bubblewrap is a really interesting project, really worth checking out. https://github.com/containers/bubblewrap It's the base for Flatpack, the thing that makes Flatpack be sandboxed. I use it to run Claude Code / Codex / Gemini CLI, to make sure that they have a limited / fake view of my system. You can bind directories into it, or overlay them into it, restrict other kinds of access. If Docker is a thing in a scale between a VM and your OS, Bubblewrap is a thing a scale between Docker and your OS. You use your OS, instead of installing and managing an OS like you do with Docker, but you get filesystem and process isolation like with Docker. Though I had an issue where I cannot use `-…

It depends - for what? If your security model is sandboxing an agent to ensure they don't nuke your PC, then there are a lot of options, you can use something like bubblewrap[1] or a microVM like libkrun[2] if your goal is light-weight, up to full Docker if you want the tooling that comes with that. [1] https://github.com/containers/bubblewrap [2] https://github.com/libkrun/libkrun

Bubblewrap tends to be better at defaults than docker/rancher/podman, where the users rarely use `USER` and/or drop elevated privileges, it still has the same limitations. It is just the reality that namespace/seccomp/ebpf/cgroups are privilege dropping and are not jails. But it is better with common command line options like: $ bwrap --ro-bind /usr /usr --ro-bind /bin /bin --ro-bind /lib /lib --ro-bind /lib64 /lib64 --ro-bind /sbin /sbin --ro-bind /etc /etc --proc /proc --dev /dev --tmpfs /tmp /usr/bin/bash $ grep ^Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 0000000000000000 CapAmb: 0000000000000000 $ grep ^NoNew /proc/$$/status …

Self hosting can be doable for constant small/medium size workloads You can handroll a lot with: https://github.com/nestybox/sysbox?tab=readme-ov-file https://gvisor.dev https://github.com/containers/bubblewrap?tab=readme-ov-file For hardware virtualized machines it much harder but you can do it via: https://github.com/firecracker-microvm/firecracker/ https://github.com/cloud-hypervisor/cloud-hypervisor Freestyle/other providers will likely provide better debugging experience but thats something you can probably get past for a lot of workloads. The time when you/anyone should think about Freestyle/anyone is when the load spikes/the need to create hundreds of VMs in short spikes shows up,…

> The claude sandbox is a good idea, but to be effective it would need to be implemented at a very low level and enforced on all programs that claude launches. I feel like an integration with bubblewrap, the sandboxing tech behind Flatpak, could be useful here. Have all executed commands wrapped with a BW context to prevent and constrain access. https://github.com/containers/bubblewrap

My bad, looks like I misunderstood how bash-tool works. Then how about running Claude Code or your harness of choice inside bubblewrap with a shim/stub for the base binary? https://github.com/containers/bubblewrap

Bubblewrap supports overlayfs mounts [1]. Seems like you should be able to replicate that flow with it. [1] https://github.com/containers/bubblewrap/issues/412

Probably not. Maybe Bubblewrap and sandbox-run. It's an anything-is-already-way-better-than-nothing type of thing. [0]: https://github.com/containers/bubblewrap [1]: https://github.com/sandbox-utils/sandbox-run

…tween the sandboxed processes and the host system is entirely determined by the arguments passed to bubblewrap. > Everything mounted into the sandbox can potentially be used to escalate privileges. This is not a robust system designed for security first. You can use this to be (much) more secure than otherwise, but it's not a security-oriented design, unlike Qubes. > Anything in the disposable VM is still at risk. Which means nothing. Disposable can't store anything, it's destroyed every time you stop it. > You've said before you don't have a lot of security knowledge and it continues to show. I see the same about you. You keep repeating some myths about Qubes OS based on misunderstand…