Repository navigation
[Bubblewrap/LXC/WSLC] protect files that run later inside writable grants #1445
Description
Description of the new feature / enhancement
A script that may write a project folder can plant files that run later, outside the sandbox, as the user: .git/hooks/* and .git/config, .vscode/ and .idea/ task and settings files, shell start-up files (.bashrc, .profile, ...), .mcp.json and agent command folders. A read-write bind does not stop this. The docs already warn that dotfiles in HOME are read as configuration when HOME is the working directory; this is the same hazard for the grant itself.
Proposed technical implementation details
- For each
readwritePathsgrant, lay a fixed list of those paths read-only over the existing entries (--ro-bind-tryof the path onto itself), including nested ones found by a depth-limited search. - For a top-level name that does not exist yet, bind a placeholder (
/dev/nullfor a file, a read-only tmpfs for a folder) and remove it after the run. - Add one line to a failed run's result naming the rule that blocked the write.
- Either a default list with an opt-out, or an explicit
protectedPathsfield; whichever fits the schema better.
Acceptance criteria:
- A script cannot create or change
.git/hooks/pre-commit,.git/config,.vscode/tasks.jsonor.bashrcin a read-write grant, and can change an ordinary file next to them. - Placeholders are cleaned up after the run, including after a crash.
Known limits we would document: a protected name that does not exist and is nested deeper than the search is not prevented; symlinks inside the grant need care.
We have this in another bubblewrap-based sandbox and can contribute a PR.
Activity
kenchris commentedon Oct 7, 2026
A clarification on the description after running the Windows ProcessContainer and WSLC backends with a local build:
readonlyPathscarve-outs inside areadwritePathsgrant are enforced. With.git/hooksand.git/configlisted read-only inside a writable folder, writes to them were refused (WSLC: "Read-only file system") while ordinary files stayed writable. So "a read-write bind does not stop this" is true only for a plain grant; the capability exists..vscode/tasks.jsonthat does not exist produced only a warning ("the backend may fail at mount time"), and the contained script then created the file. A placeholder (file bound from/dev/null, folder as a read-only tmpfs) closes that.We did not test the Bubblewrap backend (no Linux host); that part is from reading the sources. Sorry for overstating the first point in the description.
[-]Bubblewrap: protect files that run later inside writable grants[/-][+][Bubblewrap/LXC/WSLC] protect files that run later inside writable grants[/+]