标签：#bubblewrap

In sandbox runtimes, "isolation" is the core requirement. qwrap (based on bwrap user namespace) and Container (podman/docker) are two mainstream backends. They solve the same problem — running code in a restricted environment — but take completely different paths. This article uses extensive analogies to help you understand the similarities and differences. Building Intuition: Two Ways to "Lock the Door" Imagine you need to confine someone you don't fully trust in a room to do work: qwrap approach : In your existing house, you put up a partition to wall off a corner, leaving only a small window to pass materials through. The walls are still the original walls, the floor is still the original floor, but the person can only see what's inside the partition. Container approach : You build a shipping container with its own independent power, water, and ventilation systems. Put the person inside, close the door. They feel like they're in a complete little house, completely unaware of what's outside. This is the most fundamental difference: qwrap is lightweight view isolation, Container is complete environment encapsulation . What is qwrap (bwrap user namespace) qwrap uses bubblewrap (bwrap) under the hood, a sandboxing tool that leverages Linux user namespaces. How it Works Host filesystem ├── /usr/bin/python3 ← Host's Python ├── /home/user/project/ ← User project └── /tmp/secrets/ ← Sensitive files qwrap sandbox view (what the process sees) ├── /usr/bin/python3 ← bind-mounted in, read-only ├── /workspace/ ← Only the project directory is exposed └── (/tmp/secrets/ doesn't exist) ← Completely invisible Key mechanisms: User Namespace : The process thinks it's root, but actually maps to an unprivileged user on the host Mount Namespace : Only bind-mounts necessary directories in, everything else is invisible No images, no layers, no network namespace (unless explicitly configured) Analogy: VPN Split Tunneling qwrap is like split-tunneling rules on your phone — you're not wrap