https://cybertoolchain.io/tools/bubblewrap New releases and features in Bubblewrap, tracked by The Cyber Toolchain. en Wed, 14 Oct 2026 12:21:00 GMT https://github.com/containers/bubblewrap/releases/tag/v0.13.1 https://github.com/containers/bubblewrap/releases/tag/v0.13.1 Wed, 14 Oct 2026 12:21:00 GMT bubblewrap v0.13.1 allows multiple `--sync-fd` arguments to be passed in a single invocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports multiple `--sync-fd` arguments in a single `bwrap` invocation, with all provided file descriptors handled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.13.0 https://github.com/containers/bubblewrap/releases/tag/v0.13.0 Tue, 22 Sep 2026 11:40:46 GMT Bubblewrap v0.13.0 adds mount_setattr() for mount flag remounting, rejects empty path args, and introduces `-Ddebug_logging=true` with `DEBUG_INVOCATION`⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-Ddebug_logging=true` build option to enable verbose debug logging, gated at runtime by the `DEBUG_INVOCATION` environment variable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Path arguments such as `--bind` and `--overlay-src` now reject empty strings instead of silently treating them as the root directory. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.12.0 https://github.com/containers/bubblewrap/releases/tag/v0.12.0 Wed, 26 Aug 2026 10:11:18 GMT Bubblewrap v0.12.0 adds `--not-a-security-boundary` flag, `assume_kernel` build option, and drops setuid support • Adds `--not-a-security-boundary` flag, which makes failures in sandbox setup steps (such as remounting a submount) non-fatal — enabling fail-open behavior for use cases that do not require a strict security boundary. • Adds `assume_kernel` meson build option; specifying `5.6.0` or later disables the fallback implementation of openat2(RESOLVE_IN_ROOT) and removes backward compatibility code for older kernels, resulting in hard failures at runtime on unsupported kernels. • Removes support for building a setuid bubblewrap; unprivileged user namespaces are now the sole supported mechanism. Breaking changes: • Setuid bubblewrap support has been removed entirely; deployments relying on the setuid build mode will no longer work and must migrate to unprivileged user namespaces. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.11.2 https://github.com/containers/bubblewrap/releases/tag/v0.11.2 Thu, 23 Apr 2026 08:24:30 GMT Bubblewrap v0.11.2 adds `-Dsupport_setuid` build option to disable setuid mode and harden deployments. • New build option `-Dsupport_setuid=false` (now the default) disables setuid support at compile time, causing binaries to refuse to run if made setuid. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.11.0 https://github.com/containers/bubblewrap/releases/tag/v0.11.0 Wed, 30 Oct 2024 16:28:43 GMT Bubblewrap v0.11.0 adds overlay mount support and structured log-level output for better toolchain integration. • Adds `--overlay`, `--tmp-overlay`, `--ro-overlay`, and `--overlay-src` options to create overlay mounts inside sandboxes (unavailable in setuid installations). • Adds `--level-prefix` option to emit log output parseable by `logger --prio-prefix` and `systemd-cat --level-prefix=1`. Breaking changes: • The Autotools build system has been removed; Meson ≥ 0.49.0 is now required to build bubblewrap from source. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.10.0 https://github.com/containers/bubblewrap/releases/tag/v0.10.0 Wed, 14 Aug 2024 15:48:46 GMT Bubblewrap v0.10.0 adds `--[ro-]bind-fd` to mount filesystems via file descriptor, eliminating TOCTOU risks. • Adds `--bind-fd` and `--ro-bind-fd` options to mount a filesystem represented by a file descriptor, preventing time-of-check/time-of-use (TOCTOU) attacks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.6.3 https://github.com/containers/bubblewrap/releases/tag/v0.6.3 Wed, 14 Aug 2024 15:47:42 GMT Bubblewrap v0.6.3 backports `--[ro-]bind-fd` to mount filesystems via file descriptor without TOCTOU attacks. • Adds `--bind-fd` and `--ro-bind-fd` options (backported from 0.10.0) to mount a filesystem represented by a file descriptor, eliminating time-of-check/time-of-use (TOCTOU) race conditions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.9.0 https://github.com/containers/bubblewrap/releases/tag/v0.9.0 Tue, 26 Mar 2024 21:50:50 GMT Adds `--argv0` flag to set the executable name inside the sandbox. • Adds `--argv0` argument • `--symlink` is now idempotent Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.8.0 https://github.com/containers/bubblewrap/releases/tag/v0.8.0 Mon, 27 Feb 2023 13:44:56 GMT Adds `--disable-userns` and `--assert-userns-disabled` flags to control user namespace nesting • `--assert-userns-disabled`: checks that an existing userns was created with `--disable-userns`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.6.2 https://github.com/containers/bubblewrap/releases/tag/v0.6.2 Wed, 11 May 2022 14:27:52 GMT Adds Meson subproject support via `-Dbwrapdir` and `-Dtests` options • `-Dbwrapdir=...` changes the installation directory for Bubblewrap when used as a Meson subproject • `-Dtests=false` disables unit tests during the Meson build configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap https://github.com/containers/bubblewrap/releases/tag/v0.6.0 https://github.com/containers/bubblewrap/releases/tag/v0.6.0 Thu, 24 Feb 2022 14:58:30 GMT Adds `--add-seccomp` flag to specify multiple seccomp profiles • Adds `--add-seccomp` option to allow specifying multiple seccomp program files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bubblewrap