Bubblewrap

Virtualization

A lightweight tool that uses Linux user namespaces to let unprivileged users create isolated container sandboxes without needing root privileges

Track releases GitHub

C Latest v0.11.2 · 3mo ago Security brief →

Features

Creates sandboxed environments using Linux user namespaces for unprivileged users
Supports mounting specific directories, symlinks, proc and dev filesystems inside the sandbox
Provides options to hide host processes (PID namespace), network interfaces (NET namespace) and IPC resources
Can be integrated by frameworks like Flatpak, rpm-ostree, bwrap-oci for non‑root container operations

Recent releases

View all 2 releases →

v0.11.2 Breaking risk 3mo

Breaking changes

Setuid bubblewrap support deprecated; later versions will remove it

Security fixes

CVE-2026-41163: Setuid bubblewrap ptrace vulnerability allowing privilege escalation

Full changelog

This is a security update for CVE-2026-41163, which affects any system using bubblewrap 0.11.x using a setuid bubblewrap. Anyone using this should update to this release (or stop using setuid mode).

This release deprecates the support for setuid bubblewrap, and later versions of bubblewrap will no longer support it.

Bug fixes:

In setuid mode, don't run the low-privileged parts parts of the setup
as dumpable, as that allows it to be ptraced which can lead to problems.
This is CVE-2026-41163, and was reported by François Diakhate.

Enhancements:

New build option -Dsupport_setuid, which if set to false (which
is the default) disables the support for setuid. Binaries built
with this will refuse to run if made setuid. We recommend building
normal bubblewrap binaries like this, which allows you to safely
ignore any security issues that only affect setuid mode.

View release on GitHub

v0.11.1 Bug fix 4mo

Fixed SIGCHLD signal handling restoration for compatibility with Erlang and volumeicon, corrected namespace argument processing, improved CI for user namespaces, and fixed documentation links.

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.