Bubblewrap, alternative Linux à Windows Sandbox
Mis à jour le
Notre avis
Bubblewrap is a good replacement for Windows Sandbox if you're comfortable with command-line tools and scripting. It provides strong isolation using Linux namespaces and seccomp, runs without root, and resets completely on exit—just like Sandbox. However, it lacks the built-in desktop integration and automatic GUI app support of Windows Sandbox. It's best suited for developers and advanced users who need lightweight, temporary environments for running untrusted binaries or testing software without persistent changes.
- Licence
- MIT
- Prix
- Gratuit
- Dernière version
- 0.13.1
- Note
- —
Ce qui fonctionne pareil
- Both run untrusted programs in temporary, isolated environments
- Environments reset completely on exit
- No persistent changes to the host system
- Support network isolation and restricted resource access
- Designed to be lightweight and fast to start/stop
Ce qui change
- Bubblewrap is command-line only; no native GUI interface
- Windows Sandbox provides a full desktop OS instance; Bubblewrap runs single apps
- Bubblewrap requires manual setup of permissions and bind mounts
- No built-in clipboard or file sharing in Bubblewrap without extra configuration
- Windows Sandbox starts a full Windows desktop; Bubblewrap is process-level isolation
Ouvrir vos fichiers Windows Sandbox
Windows Sandbox does not use a file format for saving or exporting sessions—its environment is entirely ephemeral. Bubblewrap does not import or export Sandbox files because it doesn't support Windows binaries at all. Running Windows executables is outside its scope; you'd need Wine or a VM for that. There is no compatibility layer between the two tools' execution formats.
Passer de Windows Sandbox à Bubblewrap, étape par étape
- Install bubblewrap via your package manager (e.g.,
sudo apt install bubblewrap) - Test basic isolation with
bwrap --ro-bind /usr /usr --tmpfs /home --dev /dev --unshare-all --share-net -- sh - Create wrapper scripts for common use cases (e.g., running untrusted CLI tools)
- Use
--bindto selectively expose files,--ro-bindfor read-only access - Combine with seccomp filters for stricter system call control if needed
Fonctionnalités clés de Bubblewrap
- Utilise les namespaces Linux pour l'isolation
- Prend en charge seccomp pour restreindre les appels système
- Fonctionne sans privilèges root
- Utilisé par Flatpak pour le sandboxing d'applications
- Léger comparé aux solutions basées sur machine virtuelle
- Accès au système de fichiers configurable
- Options d'isolation des processus et du réseau
- Portable sur les principales distributions
Installer Bubblewrap sous Linux
sudo apt install bubblewrapsudo apt install bubblewrapsudo dnf install bubblewrapsudo pacman -S bubblewrapsudo zypper install bubblewrapQuestions fréquentes
Can I run GUI apps with Bubblewrap like in Windows Sandbox?
Yes, but you must explicitly bind the X11 socket or use Wayland protocols. This requires extra flags and careful permission handling to avoid security leaks.
Does Bubblewrap protect against kernel exploits?
No. Like Windows Sandbox, it isolates at the OS level but doesn't protect against kernel-level attacks. Use it alongside other security layers.
Is Bubblewrap as easy as Windows Sandbox for casual users?
No. It requires command-line knowledge and scripting. Casual users may prefer tools like Firejail or Flatpak for simpler sandboxing.