10 Bubblewrap

So, Bubblewrap.

bwrap --clearenv --unshare-all --die-with-parent \
      --tmpfs / \
      --ro-bind /usr /usr \
      --ro-bind /lib64 /lib64 \
      sh

drops you into a shell where you can run some utilities but not much else because the entire root partition has been mounted on tmpfs and then only two specific trees, /usr and /lib64, have been mapped into the sandbox.

--clearenv clears all environment variables.

--unshare-all unmaps 6 namespaces: user ipc pid net uts cgroup

Bubblewrap creates the mount namespace from scratch. --tmpfs and --ro-bind create or map parts of the file system into the sandbox.

If you want to see the minimal mapping required to get sh working, you do this: ldd /usr/bin/sh, and map all the libraries it outputs. To cut a long story short, this is the minimal sandbox needed to execute sh:

bwrap --clearenv --unshare-all --die-with-parent \
      --tmpfs / \
      --ro-bind /usr/lib/libreadline.so.8 /usr/lib/libreadline.so.8 \
      --ro-bind /usr/lib/libc.so.6 /usr/lib/libc.so.6 \
      --ro-bind /lib64/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2 \
      --ro-bind /usr/lib/libncursesw.so.6 /usr/lib/libncursesw.so.6 \
      --ro-bind /usr/bin/sh /usr/bin/sh \
      sh

Add these flags if you want to poke around:

--ro-bind /usr/lib/libcap.so.2 /usr/lib/libcap.so.2 \
--ro-bind /usr/bin/ls /usr/bin/ls \