What it is
Bubblewrap runs a program in a sandbox: a private view of the file system in which it sees only the folders it’s been given, optionally without network access. It uses the kernel’s namespaces, so no root daemon is involved. It’s a building block for other tools rather than something most people run directly.
Why it’s here
- It contains the AI agents. The sandbox that limits which files they can read and write is built on it.
- It contains Flatpak apps. Flatpak runs every app inside a Bubblewrap sandbox.
- No root needed. Sandboxes are set up by your user, not a privileged service.
On CoreDesktop
Bubblewrap is installed from pacman. CoreDesktop’s AI sandbox uses Anthropic’s sandbox runtime, which relies on Bubblewrap and socat, to run opencode, Hermes Agent and Cline Desktop, and Claude Code’s own built-in sandbox uses it too. You don’t need to run bwrap yourself. update keeps it current.