id: ext.bwrap
title: Bubblewrap local namespaces
description: >
  Self-hosted extension using bubblewrap (bwrap) kernel namespaces on the
  local host. No SSH hop, no container runtime, no remote placement — the
  fastest path to an isolated workspace, and the first extension where
  network.default: deny is real (a genuine namespace with no interface)
  rather than declarative only.
handler: sandboxer.extensions.bwrap:BwrapExtension
capabilities:
  isolation_levels: [process]
  regions: []
  persistence: false
  pricing_model: self-hosted
config:
  base_dir: /tmp/sandboxer-bwrap
  # ro_binds omitted — defaults to [/usr, /bin, /lib, /lib64, /etc/resolv.conf], filtered to what exists