3 ms·
bwrap is SUID. >Bubblewrap could be viewed as *setuid* implementation of a subset of user namespaces. Emphasis on subset [...] https://github.com/containers/b
by traverseda 5y ago
bwrap is SUID.
>Bubblewrap could be viewed as *setuid* implementation of a subset of user namespaces. Emphasis on subset [...]
https://github.com/containers/bubblewrap#user-namespaces= https://github.com/containers/bubblewrap#user-namespaces=
- throwaway82652 5y agoI don't know why it says that, it's explicitly not: https://github.com/containers/bubblewrap/blob/34a8c8bc870783611bc1b10f504fcf00f9eaa08e/bubblewrap.c#L2633-L2640 https://github.com/containers/bubblewrap/blob/34a8c8bc870783... Distros without user namespaces will probably still ship the SUID version though.
- chlorion 5y agoYou can toggle between the SUID and unprivileged user namespaces implementation at compile time. I think most distros are shipping the unpriv'd userns configuration, and if they aren't they should be.