Hacker News Reader

See also Bubblewrap[1]. I use Bubblewrap all the time, because it's just useful, and a bit easier than doing things with unshare directly.

To compare and contrast: bubblewrap is lower level, and is great for embedding or using in one-off invocations, whereas firejail is more oriented towards adding a bit of hardening to everyday applications like Firefox via built-in and custom profiles.

For example, you could temporarily override a path doing something like this:

    bwrap --bind / / --bind /tmp/myoverride /usr/lib/qt5.15.2/plugins/kf5 -- ...

to, say, override the KDE plugins while testing. This is useful for me since it's rather challenging during development to actually get KDE apps to reliably load my plugins on NixOS: I think kio slaves are probably wrapped and getting other environments injected into them. Rather than bother with any tricky hacks, Linux namespaces make it relatively easy to test regardless.

Bubblewrap is used internally by Flatpak and others.

https://github.com/containers/bubblewrap

View on HN

bin=$(basename "$0") exec bwrap \ --bind "$PWD" "$PWD" \ --dev /dev \ --die-with-parent \ --dir /tmp \ --dir /var \ --disable-userns \ --new-session \ --proc /proc \ --ro-bind /etc/ca-certificates /etc/ca-certificates \ --ro-bind /etc/resolv.conf /etc/resolv.conf \ --ro-bind /etc/ssl /etc/ssl \ --ro-bind /usr /usr \ --setenv PATH /usr/bin \ --share-net \ --symlink /tmp /var/tmp \ --symlink /usr/bin /bin \ --symlink /usr/lib /lib \ --symlink /usr/lib64 /lib64 \ --unshare-all \ --unshare-user \ "/usr/bin/$bin" "$@"