Add Linux Bubblewrap sandbox#22240
Merged
Merged
Conversation
MikeMcQuaid
force-pushed
the
linux-bubblewrap-sandbox
branch
from
3737dfa to
dfdf12d
Compare
MikeMcQuaid
force-pushed
the
linux-bubblewrap-sandbox
branch
from
dfdf12d to
ca8620d
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces an experimental Linux sandbox backend for Homebrew’s Sandbox using Bubblewrap (bwrap), gated behind HOMEBREW_SANDBOX_LINUX so Linux sandboxing can be exercised in CI without becoming the default.
Changes:
- Add a Linux
Sandboximplementation backed by Bubblewrap with an availability probe and rule translation to bind/ro-bind mounts. - Add
HOMEBREW_SANDBOX_LINUXenv config (and Sorbet RBI) to opt into the Linux sandbox path. - Enable/install Bubblewrap in Linux CI and Docker images, and add Linux-focused sandbox unit tests.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| Library/Homebrew/extend/os/linux/sandbox.rb | Implements Bubblewrap-backed Linux sandboxing and availability checks. |
| Library/Homebrew/extend/os/sandbox.rb | Loads the Linux sandbox extension on Linux. |
| Library/Homebrew/env_config.rb | Adds HOMEBREW_SANDBOX_LINUX boolean env configuration. |
| Library/Homebrew/sorbet/rbi/dsl/homebrew/env_config.rbi | Adds Sorbet signature for sandbox_linux?. |
| Library/Homebrew/test/sandbox_linux_spec.rb | Adds unit tests for Linux sandbox availability and bwrap arg generation (plus basic run behavior). |
| Dockerfile | Installs bubblewrap in the Homebrew Docker image. |
| .github/workflows/tests.yml | Enables Linux sandboxing in CI and ensures bubblewrap is installed where needed. |
Files not reviewed (1)
- Library/Homebrew/sorbet/rbi/dsl/homebrew/env_config.rbi: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
MikeMcQuaid
force-pushed
the
linux-bubblewrap-sandbox
branch
19 times, most recently
from
5badcf8 to
4da60dc
Compare
p-linnane
force-pushed
the
linux-bubblewrap-sandbox
branch
from
4da60dc to
00ee4c6
Compare
Member
|
Just wanted to say I'm stoked to see this. I've tried making a similar change/feature several times now but never got it workable enough to ship. |
MikeMcQuaid
force-pushed
the
linux-bubblewrap-sandbox
branch
2 times, most recently
from
4359a34 to
6236de9
Compare
MikeMcQuaid
force-pushed
the
linux-bubblewrap-sandbox
branch
9 times, most recently
from
41a5a05 to
33df5d7
Compare
MikeMcQuaid
force-pushed
the
linux-bubblewrap-sandbox
branch
2 times, most recently
from
8cf9c3b to
0e08bc1
Compare
- Use `bwrap` to translate shared sandbox rules into rootless namespace execution. - Gate the backend behind `HOMEBREW_SANDBOX_LINUX` while the Linux policy is still experimental. - Keep macOS on its existing `sandbox-exec` path while Linux uses shared executable lookup for `bwrap`. - Auto-install `bubblewrap` from `homebrew/core` when the sandbox is enabled and no system or usable brewed binary is found. - Prefer a usable system `bwrap` from `ORIGINAL_PATHS` over a brewed one so distribution-provided binaries are used when available. - Find brewed `bwrap` from `HOMEBREW_ORIGINAL_BREW_FILE` so integration subprocesses still use the Linux sandbox. - Preserve `Sandbox#run`'s tmpdir cwd inside the `bwrap` namespace and suppress Linux PTY thread warnings after sandboxed children exit. - Expose formula, Homebrew library and Linux runtime paths as read-only binds so sandboxed source builds can run with vendored Ruby. - Keep synthetic test formula installs off the API so sandbox CI does not require network during local formula setup. - Avoid creating optional prefix `var` directories just to configure a test sandbox and remove empty Linux bind placeholders after runs. - Require a working rootless `bwrap` on GitHub Actions and install the system `bubblewrap` package before Linux tests run.
MikeMcQuaid
force-pushed
the
linux-bubblewrap-sandbox
branch
from
0e08bc1 to
936f0b2
Compare
7 tasks
3 tasks
carlocab
reviewed
May 17, 2026
Comment on lines
+263
to
+266
| formula_path = ARGV.first | ||
| # `build.rb` is handed a concrete formula file; keep reparsing from falling | ||
| # back to the API inside the Linux sandbox. | ||
| ENV["HOMEBREW_NO_INSTALL_FROM_API"] = "1" if formula_path&.end_with?(".rb") |
6 tasks
|
This is great news. Sorry I never got around to working on this one. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bwrapto translate shared sandbox rules into rootless namespace execution.HOMEBREW_SANDBOX_LINUXwhile the Linux policy is still experimental.bubblewrapis missing.bubblewrapin Linux CI and Docker images so test-bot exercises the sandbox path.brew lgtm(style, typechecking and tests) with your changes locally?OpenAI Codex 5.5 xhigh with manual review, (unit not Linux) testing and tweaking.