Isolate Linux terminal sessions with bubblewrap and iptables.
npx skills add https://github.com/latchagent/latch-core --skill enclave-bubblewrap
Please help me install this Agent Skill. Skill: enclave-bubblewrap Source: https://github.com/latchagent/latch-core/tree/main/.agents/skills/enclave-bubblewrap Command: npx skills add https://github.com/latchagent/latch-core --skill enclave-bubblewrap
This Skill isolates terminal sessions using Bubblewrap, protecting your system from unauthorized access and ensuring secure execution of code.
bwrap and iptables for filesystem and PID isolation.Use the enclave-bubblewrap skill to execute a script in an isolated Bubblewrap environment.
High-intent search queries and answers about installing and using this skill.
You can isolate terminal sessions on Linux using Bubblewrap and iptables to create an unprivileged user namespace with network isolation and filesystem access control, preventing system compromise and data exfiltration from untrusted code.
Bubblewrap sandboxing is a Linux mechanism that provides filesystem and PID isolation with minimal root permissions. You need it when running untrusted code or scripts to prevent unauthorized system-level access and data leakage.
Bubblewrap operates with minimal root permissions to establish robust security for filesystem and PID isolation. It leverages unprivileged user namespaces on Linux rather than demanding full system administrator access.
You can use iptables alongside Bubblewrap to enforce network isolation within the sandbox environment. This combination prevents isolated terminal sessions from exfiltrating data by blocking unauthorized outbound network connections.
Bubblewrap is designed exclusively for Linux environments and relies on unprivileged user namespaces. It is strictly an isolation tool, so it does not perform malware analysis or detect malicious intent within the executed untrusted code itself.
Bubblewrap is a native Linux sandboxing tool that relies on Linux-specific unprivileged user namespaces and iptables. It is not compatible with non-Linux operating systems for isolating terminal sessions or securing untrusted code.
rfdiosuaoProvides guidance for diagnosing and configuring Linux networking, including firewalls and routing.
itallstartedwithaideaConfigure process, container, or microVM isolation with resource and network limits.
martinholovskySandbox untrusted code execution with syscall filtering and resource limits.
project-axExecute agent code in isolated sandboxes across Linux, macOS, and Kubernetes.