Module bwrap 

bubblewrap-compatible front end, selected when argv[0] ends in bwrap.

bubblewrap describes a container as an ordered list of operations: bind mounts, directories, symlinks, generated files, environment edits, and namespace or capability changes. Without namespaces the description is materialized instead: a fresh private root directory receives every --dir, --symlink, --tmpfs and data-file entry, each bind becomes a Binding (read-only ones flagged), and the options that only make sense with namespaces are accepted and ignored. The result is an ordinary Config that the launcher runs like any PRoot invocation.

Known no-ops: every --unshare-*, --share-net, --disable-userns, --assert-userns-disabled, --userns*, --pidns, --uid, --gid, --cap-add, --cap-drop, --as-pid-1, --lock-file, --sync-fd, --block-fd, --userns-block-fd, --exec-label, --file-label, --mqueue (created as a plain directory), --size, --level-prefix, --not-a-security-boundary. --hostname is recorded for a future uname handler. Overlay options are refused.

Structs

Op

One parsed operation: the option, its arguments, and the --perms mode that applied to it (only for options that create an entry).

Constants

BWRAP_VERSION

Version string pressure-vessel and flatpak parse from bwrap --version.

FLAGS 🔒

ONE_ARG 🔒

THREE_ARGS 🔒

TWO_ARGS 🔒

Functions

apply_ops 🔒

Applies the operations: creates entries under root, fills bindings and environment. Pure mapping lives in map_op; this does the filesystem work.

bind 🔒

ensure_mount_point 🔒

Creates the mount point for dest inside the fresh root, so listings of the parent show it and lexical path walks find a directory there.

make_root 🔒

Creates the private root for this launch.

map_op

Applies an operation that touches only the configuration (no filesystem work).

os 🔒

parse

Parses bubblewrap-style arguments (without argv[0]) into a launchable config.

parse_fd 🔒

parse_ops

Splits the command line into operations and the command.

set_mode 🔒

start_dir

The directory a launch starts the command in, given which guest paths are directories of its view: config.cwd where the view has it, and in bwrap mode without --chdir, then $HOME of the command’s environment, as bubblewrap goes on to. None leaves the command at /.

umask 🔒

under_root 🔒

under_root_path 🔒

usage 🔒

var 🔒

The value of name in an environment of NAME=value entries.

with_pwd

env with PWD naming dir, as bubblewrap exports it once it has entered the directory the command starts in; a program reads its working directory from it, as Proton’s protonfixes does to find the game’s library.