5 ms·

I use bubblewrap directly, never liked Flatpak.

• a-french-anon 20d ago
  Same except for Steam. Hope this money revitalizes bubblewrap's development, it'd be nice to get proper signal handling cleanup up then merged (even util-linux's unshare has it, these days).
  • ximm 20d ago
    I have bad news for you: The flatpak developers plan to stop using bubblewrap. They say it is no longer necessary because most distros now support unprivileged user namespaces. https://youtu.be/NsVhkz2Xl0E?si=-ypxvTlRukCZLql9 https://youtu.be/NsVhkz2Xl0E?si=-ypxvTlRukCZLql9
    • internet_points 20d ago
      I tried to find out what unprivileged user namespaces was, and all I can find is people talking loudly about how insecure they are, e.g. https://secureblue.dev/articles/userns https://secureblue.dev/articles/userns But does bubblewrap also use them?
    • a-french-anon 20d ago
      Bubblewrap is a CLI interface for these, you know? It's been some time since bwrap recommended avoiding their SUID wrapper.
      • NekkoDroid 19d ago
        From my knowledge its a yes and no. One of the "benefits" of bwrap was that it was a SUID binary and thus maximised compatibility with systems that disabled unprivileged user namespaces. With that barrier gone you can implement a more tailored sandbox to the usecase instead of working around limitations in bwrap. Like, all things considered, bubblewrap as a whole isn't that much code (quick check seems like ~6k LOC) and does somewhat limit the API you can work with.