| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: bubblewrap | Distribution: openSUSE Tumbleweed |
| Version: 0.12.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Mon Aug 31 09:39:37 2026 |
| Group: Productivity/Security | Build host: reproducible |
| Size: 184047 | Source RPM: bubblewrap-0.12.0-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://github.com/containers/bubblewrap | |
| Summary: Core execution tool for unprivileged containers | |
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.
LGPL-2.1-or-later
* Mon Aug 31 2026 Kyle Scheuing <kyle@kylescheuing.com>
- update to 0.12.0:
* The flag --not-a-security-boundary was added. If this is enabled
then failure of some sandbox setup steps (like remounting a
submount) are not fatal.
* The license has been updated from LGPL 2.0 (or later) to LGPL 2.1
(or later).
* This version removes the support for building a setuid
bubblewrap. Changes in this version made it difficult to support
and basically all modern linux distributions now support
unprivileged user namespaces to some extent.
* The assume_kernel build option was added, if specified no backwards
compatiblity for kernels older than this is built in (and will result
in hard failures at runtime). Currently specifying 5.6.0 or
later will disable the fallback implementation of
openat2(RESOLVE_IN_ROOT).
* Bubblewrap now correctly resolves absolute symlinks during the
sandbox setup by using openat2 with RESOLVE_IN_ROOT (or a fallback
implementation). This fixes a security issue (GHSA-pxhw-h44j-8pfx)
where file or directories created during sandbox setup could
follow parent symlinks out of the sandbox.
* Wed Apr 29 2026 Michael Gorse <mgorse@suse.com>
- Update to version 0.11.2 (bsc#1262113):
* In setuid mode, don't run the low-privileged parts of the setup
as dumpable, as that allows it to be ptraced which can lead to
problems. This is CVE-2026-41163.
* New build option `-Dsupport_setuid`, which if set to false
(which is the default) disables the support for setuid.
Binaries built with this will refuse to run if made setuid.
* Wed Apr 22 2026 Antonio Larrosa <alarrosa@suse.com>
- Really drop the nobwrap.helper script as intended on Sep 29 2025.
* Mon Mar 23 2026 Dirk Müller <dmueller@suse.com>
- update to 0.11.1:
* Reset disposition of `SIGCHLD`, restoring normal subprocess
management if bwrap was run from a process that was ignoring
that signal, such as Erlang or volumeicon
* Don't ignore `--userns 0`, `--userns2 0` or `--pidns 0` if
used
* Note that using a fd number ≥ 3 for these purposes is still
* preferred, to avoid confusion with the stdin, stdout, stderr
* that will be inherited by the command inside the container.
* Fix grammar in an error message
* Fix a broken link in the documentation
* Enable user namespaces in Github Actions configuration,
fixing a CI regression with newer Ubuntu
* Clarify comments
* Mon Sep 29 2025 Dominique Leuenberger <dimstar@opensuse.org>
- Drop the nobwrap.helper again: glycin could find a solution to
detect it running in a CI/BuildEnvironment and it disarms
bubblewrap in this case, making this wrapper obsolete
* Wed Sep 10 2025 Dominique Leuenberger <dimstar@opensuse.org>
- Add a samplehelper to documentation that could be used by OBS
packages to avoid bubblewrap: nobwrap.helper
* Sun Nov 17 2024 Sebastian Wagner <sebix@sebix.at>
- fix shebang in demos/flatpak-run.sh
* Fri Nov 01 2024 Andreas Stieger <andreas.stieger@gmx.de>
- update to 0.11.0:
* New --overlay, --tmp-overlay, --ro-overlay and --overlay-src
options allow creation of overlay mounts. This feature is not
available when bubblewrap is installed setuid.
* New --level-prefix option produces output that can be parsed
by tools like logger --prio-prefix and
systemd-cat --level-prefix=1
* bug fixes and developer visible changes
- add upstream signing key and validate source signature
* Wed Aug 14 2024 Bjørn Lie <bjorn.lie@gmail.com>
- Update to version v0.10.0:
* New features: Add the --[ro-]bind-fd option, which can be used
to mount a filesystem represented by a file descriptor without
time-of-check/time-of-use attacks. This is needed when
resolving security issue in Flatpak.
(CVE-2024-42472, bsc#1229157)
* Other changes: Fix some confusing syntax in SetupOpFlag (no
functional change).
* Tue Apr 02 2024 Wolfgang Frisch <wolfgang.frisch@suse.com>
- update to v0.9.0:
* Build system changed to Meson from Autotools
* Add --argv0
https://github.com/containers/bubblewrap/issues/91
* --symlink is now idempotent, meaning it succeeds if the symlink already
exists and already has the desired target
* Clarify security considerations in documentation
* Clarify documentation for --cap-add
* Report a better error message if mount(2) fails with ENOSPC
* Fix a double-close on error reading from --args, --seccomp or
- -add-seccomp-fd argument
* Improve memory allocation behaviour
* Mon Mar 27 2023 Andreas Stieger <andreas.stieger@gmx.de>
- update to v0.8.0:
* Add --disable-userns option to prevent the sandbox from
creating its own nested user namespace
* Add --assert-userns-disabled option to check that an existing
userns was created with --disable-userns
* Give a clearer error message if the kernel doesn't have
CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER
/usr/bin/bwrap /usr/share/bash-completion /usr/share/bash-completion/completions /usr/share/bash-completion/completions/bwrap /usr/share/doc/packages/bubblewrap /usr/share/doc/packages/bubblewrap/README.md /usr/share/doc/packages/bubblewrap/demos /usr/share/doc/packages/bubblewrap/demos/bubblewrap-shell.sh /usr/share/doc/packages/bubblewrap/demos/flatpak-run.sh /usr/share/doc/packages/bubblewrap/demos/flatpak.bpf /usr/share/doc/packages/bubblewrap/demos/userns-block-fd.py /usr/share/licenses/bubblewrap /usr/share/licenses/bubblewrap/COPYING /usr/share/man/man1/bwrap.1.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Sep 11 00:08:52 2026