BubbleWrap your dev env and agents

Dawid Ciężarkiewicz's April 2026 post walks through his setup for isolating LLM coding agents and dev environments using Bubblewrap. The design goals are explicit: protect the host from malicious agents (he calls them "Slopus"), protect from malicious dependencies, and keep the usual developer UX. No separate user account, no VM, no Docker — just namespace-based sandboxing.

The `isolate` script

The core is a shell script that runs any command under bwrap with:

--dev-bind /dev /dev, --proc /proc, --tmpfs /tmp, --tmpfs /run as the base namespace scaffolding.
--ro-bind for host paths the sandbox can read: /bin, /usr/bin, /etc, /nix, $HOME/.config, dotfiles, ~/.nix-profile, etc.
--bind (read-write) for paths that need to change: ~/.cargo, ~/.claude, ~/.claude.json, the current working directory, a GPG socket.
--chmod 0700 ~/.gnupg to ensure GnuPG can't be tripped up by directory permissions.
--setenv ISOLATE_ENV "$(pwd)" so the inner shell can tell it's isolated.
--setenv PROMPT_ENV_INDICATOR "isolated" to mark the shell prompt.

The script is idempotent: if ISOLATE_ENV is already set, it just runs the command without re-wrapping. A warning is printed if /proc/sys/dev/tty/legacy_tiocsti isn't 0 — otherwise a malicious process could smuggle characters into the parent terminal.

Per-project additions come from a .isolate file sourced as bash, which can append to the bwrap args array. Example in the post: a GUI project adds binds for $WAYLAND_DISPLAY, /dev/dri/, /dev/shm, /tmp/.X11-unix/, and /run/opengl-driver/lib/ so cargo run can open a window.

Wiring into Nix

A Nix overlay replaces the claude-code derivation with a shell-script wrapper that exec's the real claude under isolate. The PATH prepends ${not-git}/bin so git is a reminder wrapper telling the agent "we're using Jujutsu." CARGO_TERM_QUIET=true is set to reduce token-burning build noise.

Net effect: any invocation of claude on this system starts already sandboxed, with no opt-in step to forget.

Wiring into tmux

A second script, auto-isolate, walks up from $PWD looking for a .isolate marker file. If found, it re-execs itself via isolate. Configured as tmux's default-command:

set-option -g default-command "$HOME/bin/auto-isolate ${SHELL}"
bind E new-window "${SHELL}"

Every new tmux pane starts under auto-isolate. Because his dev projects all live under ~/lab, dropping a .isolate in ~/lab makes every pane opened below it automatically enter the sandbox. prefix E opens an escape-hatch shell outside the sandbox when needed.

Tradeoffs he accepts

The SSH/GPG sockets are bound in. A compromised process inside the sandbox can sign things and ssh to other hosts. He accepts this because his Yubikey requires physical touch per operation, so an automated attacker is blocked by hardware.
Not a security boundary against a determined attacker. Bubblewrap uses user namespaces, which have historical CVE exposure. He calls it "good enough security and robustness without sacrificing almost any DX," not hard isolation.
~/.claude is bound read-write. The agent can write to its own state directory, which is necessary for normal operation but also means a compromised agent can poison its own memory/config.

Where this fits

Bubblewrap-based isolation is the Linux counterpart to the macOS-focused hazmat (Seatbelt + user isolation + pf firewall) and the HTTP-policy-layer crabtrap (LLM-as-judge proxy). Together these cover the three main sandboxing axes for AI agents:

Filesystem/process isolation — bubblewrap, hazmat user isolation, Seatbelt.
Network egress policy — pf firewall (hazmat), CrabTrap's HTTP interception.
Binary/syscall-level — syscall-binary-rewriting for fine-grained syscall control.

See sandboxing-ai-agents for the comparison and tradeoff matrix.

dpc-pw — author's blog
i-dont-want-your-prs — the companion post from the same author on maintainer collaboration under LLM-assisted workflows
sandboxing-ai-agents — broader concept page
hazmat, crabtrap — adjacent tools in the sandboxing space
syscall-binary-rewriting — complementary syscall-layer approach