Linux Bubblewrap
Fallback Linux backend when Landlock isn't available.
What is Linux Bubblewrap?
Bubblewrap is Watchfire's Linux sandbox fallback when Landlock isn't available — typically on kernels older than 5.13, or in environments where the Landlock LSM has been disabled at boot.
Linux Bubblewrap + Watchfire
Bubblewrap uses user namespaces, mount namespaces, and seccomp filters to construct a restricted view of the host filesystem before the agent process starts. The blast-radius contract is the same as Landlock — sensitive paths are unreadable, writes are scoped to the worktree, and the rules survive child-process exec.
Compared to Landlock, Bubblewrap is more moving parts: namespaces have to be set up, and some hardened distributions disable unprivileged user namespaces. Watchfire reports that as a startup error rather than silently degrading to an unsandboxed run.
If you have a choice, prefer Landlock. Bubblewrap exists so older fleets don't have to upgrade their kernel before adopting Watchfire.
Setup
Install bubblewrap from your distro's package manager. Watchfire will use it automatically when Landlock is not available.
# Debian / Ubuntu
sudo apt install bubblewrap
# Fedora
sudo dnf install bubblewrap
# Arch
sudo pacman -S bubblewrapGet started with Watchfire
Install in seconds. Define tasks. Let agents ship code for you.
Download for macOSAvailable for macOS, Linux, and Windows
# Install via Homebrew (macOS)brew tap watchfire-io/tapbrew install --cask watchfire-io/tap/watchfire# Set up your project and gowatchfire initwatchfire task add "Build the login page"watchfire start --allIncludes GUI, CLI, and daemon. Also available via Homebrew.