[codedokode]

Bubblewrap is very limited, for example it doesn't allow to grant access to /proc/self/exe without giving access to whole /proc subsystem. So I had to write an emulation of /proc in Python and mount it with FUSE to work around this. I wonder if this issue is fixed in landlock, firejail and others.

Also bubblewrap cannot ask for a decision in runtime: you must set up the rules beforehand.

[mid-kid]

Emulating /proc isn't super interesting when you can simply enter a new process namespace.

[codedokode]

This doesn't allow hiding things like /proc/cpuinfo or /proc/cmdline or /proc/modules etc.