Everybody knows that allowing different applications unlimited access to each other’s data is not exactly optimal from a security point of view. While servers have enjoyed containers to isolate applications from each other, we lack a good solution for the desktop. Or do we? There is, obviously, flatpak. Unfortunately, flatpak present itself as a “Linux application sandboxing and distribution framework”. This will not do. I already have a distribution. I’m pretty happy with it.

Nice series of blog posts I found detailing how to use bubblewrap (the sandboxing tool used by Flatpak) to sandbox regular programs.

  • shirroEnglish
    100·
    7 months ago7 months ago

    I was setting up a modded minecraft launcher for the family to use and and I have trust issues with the modding ecosystem and kids installing random jar files. I used bwrap and it works really well. The launcher uses wayland, minecraft typically X, needs dri access for opengl, pipewire, input devices, networking and dns resolve to connect to servers etc. Doesn’t need filesystem access to much other than some shared libs (ro) and a directory in .config. There is a bit of trial and error involved and making the bwrap robust to differences between desktops (different sockets for dns or mdns resolvers) and makes me appreciate apps packaged as flatpak as this level of sandboxing should be standardised for all distributed apps. Half the stuff in AUR should be bwrapped IMO.

  • iiGxC
    80·
    7 months ago

    I’ve been meaning to set up sandboxing, this is super helpful! Thanks

  • Throwaway1234
    60·
    7 months ago

    Does anyone happen to know if bubblewrap is more powerful than bubblejail (or vice versa). Or how they differ in the first place (beyond CLI vs GUI)?

    • dsemyOPEnglish
      40·
      7 months ago

      bubblejail is based on bubblewrap.