Hey all,
so I was thinking about using bubblewrap for some applications, which I would like to not use in a VM and for which I kept a separate user (and added it to xhost thus basically negating any isolation...). Now I wanted to improve on this (especially as handling multiple users with shared files is a pain even with sticky bit's and ACL) and would like to run everything from one user but properly deny access to the main X(Wayland)-server and certain directories.

Unfortunately I want (IP)network access and thus I have (?) to use --share-net with bubblewrap. And this is there the plan of one user and X-isolation falls completely apart for Xwayland and bugged me on my remaining X workstation. Apparently XWayland only authenticates by user (xhost +SI:localuser:) AND X11 listens on abstract sockets by default on Linux since 2014... So there is no way to deny the bubblewrapped program access to X11 (--unshare-user seems to somehow keep the uid for socket-access purposes) if I want network with bubblewrap.

Possible mediations I see:

• would you support inclusion of a --share-net-ip option (if its possible to do, sharing IP-network access and NOT abstract sockets) - I would gladly try to understand and contribute If you point me to fitting resources
• can I somehow influence/reroute/attach to the network-namespace of the container?
• can I use nsenter before calling bubblewrap to provide my own network namespace?
• using sandstorm.io (though I miss the reference to the commandline there) or nsjail ;)

Thanks in advance for thinking about my problem!