# BubbleWrap your dev env and agents

[[dpc-pw|Dawid Ciężarkiewicz]]'s April 2026 post walks through his setup for isolating LLM coding agents and dev environments using [Bubblewrap](https://github.com/containers/bubblewrap). The design goals are explicit: protect the host from malicious agents (he calls them "Slopus"), protect from malicious dependencies, and keep the usual developer UX. No separate user account, no VM, no Docker — just namespace-based sandboxing.

## The `isolate` script

The core is a shell script that runs any command under `bwrap` with:

- `--dev-bind /dev /dev`, `--proc /proc`, `--tmpfs /tmp`, `--tmpfs /run` as the base namespace scaffolding.
- `--ro-bind` for host paths the sandbox can read: `/bin`, `/usr/bin`, `/etc`, `/nix`, `$HOME/.config`, dotfiles, `~/.nix-profile`, etc.
- `--bind` (read-write) for paths that need to change: `~/.cargo`, `~/.claude`, `~/.claude.json`, the current working directory, a GPG socket.
- `--chmod 0700 ~/.gnupg` to ensure GnuPG can't be tripped up by directory permissions.
- `--setenv ISOLATE_ENV "$(pwd)"` so the inner shell can tell it's isolated.
- `--setenv PROMPT_ENV_INDICATOR "isolated"` to mark the shell prompt.

The script is idempotent: if `ISOLATE_ENV` is already set, it just runs the command without re-wrapping. A warning is printed if `/proc/sys/dev/tty/legacy_tiocsti` isn't `0` — otherwise a malicious process could smuggle characters into the parent terminal.

Per-project additions come from a `.isolate` file sourced as bash, which can append to the `bwrap` args array. Example in the post: a GUI project adds binds for `$WAYLAND_DISPLAY`, `/dev/dri/`, `/dev/shm`, `/tmp/.X11-unix/`, and `/run/opengl-driver/lib/` so `cargo run` can open a window.

## Wiring into Nix

A Nix overlay replaces the `claude-code` derivation with a shell-script wrapper that exec's the real claude under `isolate`. The `PATH` prepends `${not-git}/bin` so `git` is a reminder wrapper telling the agent "we're using Jujutsu." `CARGO_TERM_QUIET=true` is set to reduce token-burning build noise.

Net effect: any invocation of `claude` on this system starts already sandboxed, with no opt-in step to forget.

## Wiring into tmux

A second script, `auto-isolate`, walks up from `$PWD` looking for a `.isolate` marker file. If found, it re-execs itself via `isolate`. Configured as tmux's `default-command`:

```
set-option -g default-command "$HOME/bin/auto-isolate ${SHELL}"
bind E new-window "${SHELL}"
```

Every new tmux pane starts under `auto-isolate`. Because his dev projects all live under `~/lab`, dropping a `.isolate` in `~/lab` makes every pane opened below it automatically enter the sandbox. `prefix E` opens an escape-hatch shell outside the sandbox when needed.

## Tradeoffs he accepts

- **The SSH/GPG sockets are bound in.** A compromised process inside the sandbox can sign things and ssh to other hosts. He accepts this because his Yubikey requires physical touch per operation, so an automated attacker is blocked by hardware.
- **Not a security boundary against a determined attacker.** Bubblewrap uses user namespaces, which have historical CVE exposure. He calls it "good enough security and robustness without sacrificing almost any DX," not hard isolation.
- **`~/.claude` is bound read-write.** The agent can write to its own state directory, which is necessary for normal operation but also means a compromised agent can poison its own memory/config.

## Where this fits

Bubblewrap-based isolation is the Linux counterpart to the macOS-focused [[hazmat]] (Seatbelt + user isolation + pf firewall) and the HTTP-policy-layer [[crabtrap]] (LLM-as-judge proxy). Together these cover the three main sandboxing axes for AI agents:

- Filesystem/process isolation — bubblewrap, hazmat user isolation, Seatbelt.
- Network egress policy — pf firewall (hazmat), CrabTrap's HTTP interception.
- Binary/syscall-level — [[syscall-binary-rewriting]] for fine-grained syscall control.

See [[sandboxing-ai-agents]] for the comparison and tradeoff matrix.

## Related

- [[dpc-pw]] — author's blog
- [[i-dont-want-your-prs]] — the companion post from the same author on maintainer collaboration under LLM-assisted workflows
- [[sandboxing-ai-agents]] — broader concept page
- [[hazmat]], [[crabtrap]] — adjacent tools in the sandboxing space
- [[syscall-binary-rewriting]] — complementary syscall-layer approach