3 ms·

I also use bubblewrap to isolate npm/pnpm/yarn (and everything started by them) from the rest of the system. Let's say all your source code resides in ~/code; p

I also use bubblewrap to isolate npm/pnpm/yarn (and everything started by them) from the rest of the system. Let's say all your source code resides in ~/code; put this somewhere in the beginning of your $PATH and name it `npm`; create symlinks/hardlinks to it for other package managers: #!/usr/bin/bash bin=$(basename "$0") exec bwrap \ --bind ~/.cache/nodejs ~/.cache \ --bind ~/code ~/code \ --dev /dev \ --die-with-parent \ --disable-userns \ --new-session \ --proc /proc \ --ro-bind /etc/ca-certificates /etc/ca-certificates \ --ro-bind /etc/resolv.conf /etc/resolv.conf \ --ro-bind /etc/ssl /etc/ssl \ --ro-bind /usr /usr \ --setenv PATH /usr/bin \ --share-net \ --symlink /tmp /var/tmp \ --symlink /usr/bin /bin \ --symlink /usr/bin /sbin \ --symlink /usr/lib /lib \ --symlink /usr/lib /lib64 \ --tmpfs /tmp \ --unshare-all \ --unshare-user \ "/usr/bin/$bin" "$@" The package manager started through this script won't have access to anything but ~/code + read-only access to system libraries: bash-5.3$ ls -a ~ . .. .cache code bubblewrap is quite well tested and reliable, it's used by Steam and (IIRC) flatpak.

johnisgood 1y ago
Firejail is quite good, too. I have been using firejail more than bubblewrap.
shermantanktop 1y ago
This is trading one distribution problem (npx) for another (bubblewrap). I think it’s a reasonable trade, but there’s no free lunch.
- homebrewer 1y ago
  Not sure what this means. bubblewrap is as free as it gets, it's just a thin wrapper around the same kernel mechanisms used for containers, except that it uses your existing filesystems instead of creating a separate "chroot" from an OCI image (or something like it). The only thing it does is hiding most of your system from the stuff that runs under it, whitelisting specific paths, and optionally making them readonly. It can be used to run npx, or anything else really — just shove move symblinks into the beginning of your $PATH, each referencing the script above. Run any of them and it's automatically restricted from accessing e.g. your ~/.ssh https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Bubblewrap
  - conception 1y ago
    It means that someone just has to compromise bubblewrap instead of the other vectors.
    - cozzyd 1y ago
      sure but surely one gets bubblewrap from their distro, and you have to trust your distro anyway.
    - theamk 1y ago
      Not "instead", it's "in addition to". Your classical defense-in-depth.
      - oulipo2 1y ago
        No, "instead". If they compromise bubblewrap to send out your files, and you run bubblewrap anyway for any reason, you're still compromised. But obviously you can probably safely pin bubblewrap to a given version, and you don't need to "install packages through it", which is the main weakness of package managers
        aragilar 1y ago
        How? bubblewrap isn't something someone has randomly uploaded to npm, it has well known maintainers and a well organised release process (including package signing). Which is easier to do: upload a package to npm and get people to use it, or spend 2+ years trying to become a maintainer of bubblewrap or one of its dependencies to compromise it.
        oulipo2 1y ago
        Sure, but there's plenty of packages with well-known maintainers who get compromised...
        haswell 1y ago
TheTaytay 1y ago
Very cool. Hadn't heard of this before. I appreciate you posting it.
oulipo2 1y ago
Will this work on osX? and for pnpm?
- aragilar 1y ago
  No, bubblewrap uses linux namespaces. You can use for (almost) whatever software you want.
internet_points 1y ago
Thanks, handy wrapper :) Note: --symlink /usr/lib /lib64 \ should probably be `/usr/lib64` and --share-net \ should go after the `--unshare-all --unshare-user` Also, my system doesn't have a symlink from /tmp to /var/tmp, so I'm guessing that's not needed for me (while /bin etc. are symlinks)
deleted 1y ago
[deleted]
aorth 1y ago
Very cool idea. Thanks for sharing. I made some minor tweaks based on feedback to your comment: #!/usr/bin/env bash # # See: https://news.ycombinator.com/item?id=45034496 bin=$(basename "$0") echo "===========================" echo "Wrapping $bin in bubblewrap" echo "===========================" exec bwrap \ --bind ~/.cache ~/.cache \ --bind "${PWD}" "${PWD}" \ --dev /dev \ --die-with-parent \ --disable-userns \ --new-session \ --proc /proc \ --ro-bind /etc/ca-certificates /etc/ca-certificates \ --ro-bind /etc/resolv.conf /etc/resolv.conf \ --ro-bind /etc/ssl /etc/ssl \ --ro-bind /usr /usr \ --setenv PATH /usr/bin \ --symlink /usr/bin /bin \ --symlink /usr/bin /sbin \ --symlink /usr/lib /lib \ --symlink /usr/lib64 /lib64 \ --tmpfs /tmp \ --unshare-all \ --unshare-user \ --share-net \ /usr/bin/env "$bin" "$@" Notably `--share-net` should be moved down since it is negated by `--unshare-all`. I also added a reminder that the command is being bubblewrapped, modified the second read-write bind to the current directory, and changed the final exec to use `/usr/bin/env` to find the binary so it can be more flexible. I tested it with npm and yarn just now and it seems to work well. Thanks!

johnisgood 1y ago

Firejail is quite good, too. I have been using firejail more than bubblewrap.

shermantanktop 1y ago

This is trading one distribution problem (npx) for another (bubblewrap). I think it’s a reasonable trade, but there’s no free lunch.

homebrewer 1y ago
Not sure what this means. bubblewrap is as free as it gets, it's just a thin wrapper around the same kernel mechanisms used for containers, except that it uses your existing filesystems instead of creating a separate "chroot" from an OCI image (or something like it). The only thing it does is hiding most of your system from the stuff that runs under it, whitelisting specific paths, and optionally making them readonly. It can be used to run npx, or anything else really — just shove move symblinks into the beginning of your $PATH, each referencing the script above. Run any of them and it's automatically restricted from accessing e.g. your ~/.ssh https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Bubblewrap
- conception 1y ago
  It means that someone just has to compromise bubblewrap instead of the other vectors.
  - cozzyd 1y ago
    sure but surely one gets bubblewrap from their distro, and you have to trust your distro anyway.
  - theamk 1y ago
    Not "instead", it's "in addition to". Your classical defense-in-depth.
    - oulipo2 1y ago
      No, "instead". If they compromise bubblewrap to send out your files, and you run bubblewrap anyway for any reason, you're still compromised. But obviously you can probably safely pin bubblewrap to a given version, and you don't need to "install packages through it", which is the main weakness of package managers
      - aragilar 1y ago
        How? bubblewrap isn't something someone has randomly uploaded to npm, it has well known maintainers and a well organised release process (including package signing). Which is easier to do: upload a package to npm and get people to use it, or spend 2+ years trying to become a maintainer of bubblewrap or one of its dependencies to compromise it.
        oulipo2 1y ago
        Sure, but there's plenty of packages with well-known maintainers who get compromised...
        haswell 1y ago

TheTaytay 1y ago

Very cool. Hadn't heard of this before. I appreciate you posting it.

oulipo2 1y ago

Will this work on osX? and for pnpm?

aragilar 1y ago
No, bubblewrap uses linux namespaces. You can use for (almost) whatever software you want.

internet_points 1y ago

Thanks, handy wrapper :) Note: --symlink /usr/lib /lib64 \ should probably be `/usr/lib64` and --share-net \ should go after the `--unshare-all --unshare-user` Also, my system doesn't have a symlink from /tmp to /var/tmp, so I'm guessing that's not needed for me (while /bin etc. are symlinks)

deleted 1y ago

[deleted]

aorth 1y ago

Very cool idea. Thanks for sharing. I made some minor tweaks based on feedback to your comment: #!/usr/bin/env bash # # See: https://news.ycombinator.com/item?id=45034496 bin=$(basename "$0") echo "===========================" echo "Wrapping $bin in bubblewrap" echo "===========================" exec bwrap \ --bind ~/.cache ~/.cache \ --bind "${PWD}" "${PWD}" \ --dev /dev \ --die-with-parent \ --disable-userns \ --new-session \ --proc /proc \ --ro-bind /etc/ca-certificates /etc/ca-certificates \ --ro-bind /etc/resolv.conf /etc/resolv.conf \ --ro-bind /etc/ssl /etc/ssl \ --ro-bind /usr /usr \ --setenv PATH /usr/bin \ --symlink /usr/bin /bin \ --symlink /usr/bin /sbin \ --symlink /usr/lib /lib \ --symlink /usr/lib64 /lib64 \ --tmpfs /tmp \ --unshare-all \ --unshare-user \ --share-net \ /usr/bin/env "$bin" "$@" Notably `--share-net` should be moved down since it is negated by `--unshare-all`. I also added a reminder that the command is being bubblewrapped, modified the second read-write bind to the current directory, and changed the final exec to use `/usr/bin/env` to find the binary so it can be more flexible. I tested it with npm and yarn just now and it seems to work well. Thanks!