Bubblewrap Without the Pain

Bubblewrap is the sandboxing technology behind Flatpak. It uses Linux namespaces to isolate processes from the rest of your system - limiting filesystem access, network capabilities, and more. It’s powerful stuff. The problem is that actually using it requires memorizing dozens of flags and getting the incantation exactly right. One wrong flag and your sandbox either doesn’t work or is too restrictive to be useful.

bui is an attempt to fix this. It’s beta, but it’s simple - it mainly just generates a bubblewrap command based on your choices and, if you’re happy, runs it. You can save working configurations as profiles and create “managed sandboxes” that permanently sandbox applications with a wrapper script. It also supports optional network filtering via pasta and, if configured, a lightweight DNS proxy.