# Enclave Bubblewrap

> Enclave Bubblewrap (Linux)

- Skill: `latchagent/enclave-bubblewrap` (Agent Skill)
- Install (CLI): `npx skillmds@latest add latchagent/enclave-bubblewrap`
- Raw SKILL.md: https://api.skillmd.com/api/skills/latchagent/enclave-bubblewrap/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: latchagent (https://skillmd.com/u/latchagent)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/latchagent/enclave-bubblewrap

---

# Enclave Bubblewrap (Linux)

## What This Module Does

The Bubblewrap Enclave (`src/main/lib/sandbox/bubblewrap-enclave.ts`) provides a native Linux sandbox backend using `bwrap` (bubblewrap) and `iptables`. It uses unprivileged user namespaces for filesystem and PID isolation.

## bwrap Configuration

Per-session with minimal root:
- **Filesystem:** Read-only /usr, /lib, /bin, /sbin, /etc. Read-write workspace at /workspace. Isolated /tmp via tmpfs.
- **PID Namespace:** --unshare-pid for process isolation
- **Proc:** /proc/self/environ bound to /dev/null (blocks credential extraction)
- **Home:** tmpfs (minimal, no host home access)
- **Lifecycle:** --die-with-parent ensures sandbox dies if Latch exits

## iptables Rules

Network forcing rules (require root/sudo):
- Redirect outbound TCP from sandbox UID to proxy port
- Block UDP/53 (DNS exfiltration prevention)
- Allow loopback to proxy and authz ports
- Drop all other outbound

## Key API

- `buildBwrapArgs(opts)` — Generate bwrap CLI arguments
- `generateIptablesRules(opts)` — Create iptables rule set
- `generateIptablesCleanup(opts)` — Create iptables cleanup commands
- `detect()` — Check if bwrap is available (Linux only)

## Testing

Run: `npx vitest run src/main/lib/sandbox/bubblewrap-enclave.test.ts`