Low-level unprivileged sandboxing tool used by Flatpak and similar projects

linux-containers user-namespaces

• Updated Oct 14, 2026
• C

containers oci linux-containers user-namespaces bubblewrap

• Updated Dec 22, 2020
• Makefile

StemJail: Dynamic Role Compartmentalization

security sandbox linux-namespaces user-namespaces

• Updated Oct 1, 2016
• Rust

Run Windows programs against a real Windows installation mounted as C: - Wine keeps the syscall boundary, Microsoft provides the world

windows linux rust wine windows-registry colony overlayfs user-namespaces iced compatibility-layer dxvk binfmt-misc linux-gaming vkd3d-proton project-colony

• Updated Nov 10, 2026
• Rust

Give a friend a quota-capped corner of your ZFS pool for raw encrypted backups, without giving them a shell

ssh backup nixos zfs user-namespaces openzfs sanoid syncoid

• Updated Oct 3, 2026
• Python

A pure-Go implementation of fakeroot using Linux user namespaces.

linux golang fakeroot user-namespaces

• Updated Oct 24, 2023
• Go

Simple desktop application sandboxing tool for GNU\Linux

linux gnu-linux sandbox desktop sandboxing linux-containers user-namespaces bubblewrap bwrap

• Updated Sep 23, 2026
• C

Very experimental docker authorization plugin, disabling some trivial ways of gaining root via docker

docker experimental user-namespaces

• Updated May 24, 2018
• Go

Run untrusted third-party installers (curl | sh) in an unprivileged FUSE copy-on-write sandbox and review changes before applying them

linux rust cli security fuse sandbox installer deb rpm overlayfs user-namespaces

• Updated Nov 8, 2026
• Rust

Limit SFTP access to a remote (Linux) system

linux ssh sftp user-namespaces

• Updated Oct 26, 2024
• Shell

Experiments with unshare

python sandboxing seccomp linux-containers user-namespaces unshare

• Updated Sep 21, 2018
• Python

Kernel patches for non-init user namespace on FUSE filesystem

linux fuse kernel user-namespaces kinvolk

• Updated Feb 7, 2018
• Shell

Nesting containers with podman

linux docker virtualization docker-in-docker containerization user-namespaces podman podman-in-podman

• Updated Sep 27, 2025
• Shell

Runs commands in Linux containers with configurable levels of isolation.

containers namespace linux-containers user-namespaces

• Updated Sep 20, 2017
• Go

Experiment with NFS mount in a user namespace

user-namespaces kinvolk

• Updated Nov 10, 2020
• C

A nix shell running in a (thin) container

nix container user-namespaces nix-flake

• Updated Sep 18, 2023
• Go

Instant, isolated, single-file Linux root-shell sandboxes built from a flag. A lightweight Docker/proot/chroot alternative with no daemon and no sudo.

linux bash cli sandbox container dev-environment overlayfs user-namespaces proot bubblewrap docker-alternative root-shell

• Updated Nov 1, 2026
• Shell

Droidspaces container kernel patches and flashable boot images for Xiaomi 17 (pudding, SM8850) on Android 17 / HyperOS 4.0.0.9-4.0.0.26 with the Android Common Kernel 6.12 GKI baseline

android linux-kernel container bazel android-kernel boot-image user-namespaces pid-namespaces pudding hyperos gki devtmpfs kernelsu android-17 sm8850 droidspaces kleaf xiaomi-17 sysvipc ipc-namespaces

• Updated Sep 15, 2026
• Shell

Real apt + dpkg that install Debian packages into ~/.local without root, built only on what Debian ships: user and mount namespaces, unprivileged overlayfs and systemd's user manager. Services run as sandboxed user units. Plain bash, no containers or helpers.

package-manager debian apt dpkg systemd sandbox arm64 termux seccomp overlayfs user-namespaces unprivileged rootless no-root mobian

• Updated Sep 29, 2026
• Shell

Dots

linux dotfiles sandboxing user-namespaces bubblewrap

• Updated Jan 29, 2026
• Shell