{"id":22293578,"url":"https://github.com/xi/xiwrap","last_synced_at":"2025-03-25T22:18:14.491Z","repository":{"id":245321340,"uuid":"817908644","full_name":"xi/xiwrap","owner":"xi","description":"slightly higher-level container setup utility","archived":false,"fork":false,"pushed_at":"2025-02-09T17:14:37.000Z","size":36,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-09T18:25:26.533Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/xi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-20T17:35:23.000Z","updated_at":"2025-02-09T17:14:40.000Z","dependencies_parsed_at":"2024-06-21T11:43:09.571Z","dependency_job_id":"83b38ed1-c0f3-4474-9978-95d1284fa031","html_url":"https://github.com/xi/xiwrap","commit_stats":null,"previous_names":["xi/xiwrap"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxiwrap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxiwrap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxiwrap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxiwrap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/xi","download_url":"https://codeload.github.com/xi/xiwrap/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245550681,"owners_count":20633883,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-03T17:29:43.792Z","updated_at":"2025-03-25T22:18:14.471Z","avatar_url":"https://github.com/xi.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"xiwrap - slightly higher-level container setup utility\n\nxiwrap is a thin wrapper around\n[bwrap](https://github.com/containers/bubblewrap) that adds some features:\n\n-   configuration can be included from files. This allows to create a library\n    of reusable modules.\n-   [xdg-dbus-proxy](https://github.com/flatpak/xdg-dbus-proxy) is integrated\n    to allow dbus filtering.\n\n## Example usage\n\n```\nxiwrap --include host-os --dbus-talk org.freedesktop.portal.Desktop -- bash\n```\n\nSee `xiwrap --help` for a full list of options.\n\n## Security disclaimer\n\nI am not an expert and this project is meant more for learning and\nexperimenting than for production use.\n\n## Why another tool?\n\nLinux has great low-level sandboxing features. However, I feel like we have not\nyet found the right high level abstraction. Docker, systemd, and flatpak are\nall great, but I think we can do better.\n\nThere is a sprawling, messy ecosystem of tools (mostly centered around bwrap\nand [firejail](https://github.com/netblue30/firejail)) that experiment with\nalternative designs. I think this is great. We have to allow for some creative\nchaos to come up with great designs. xiwrap is my contribution to that mess.\n\nThe real goal is to find a set of reusable, easy-to-understand configuration\nmodules. xiwrap is only a tool that allows me to easily iterate on those\nmodules.\n\n## Why not flatpak?\n\nflatpak is a mature and well established project that also uses bwrap and\nxdg-dbus-proxy. I actually really like [the high level\npermissions](https://docs.flatpak.org/en/latest/sandbox-permissions.html) they\nhave been building.\n\nHowever, flatpak does much more then just sandboxing. With flatpak, libraries\nare not managed centrally, but come bundle with each app. As a result, they are\noften redundant or even outdated. This is because flatpak's main goal is to\nsimplify packaging for Linux. Their vision is that users get their apps\ndirectly from developers instead of going through distros. Sandboxing is a\nnecessary condition for that vision, but not a goal in itself. Much of the\ncriticism flatpak received ([[1]](http://flatkill.org/)\n[[2]](https://ludocode.com/blog/flatpak-is-not-the-future)) is targeted at this\nsecond aspect.\n\nSo you can think of xiwrap as an attempt to build something that has all of\nflatpak's sandboxing features, but none of the rest. Not because flatpak is\nbad, but because strong, usable sandboxing is also useful in the context of a\ntraditional distro.\n\n## Prior Art\n\n-   https://github.com/flatpak/flatpak/issues/3638\n-   https://wiki.archlinux.org/title/Bubblewrap/Examples\n-   https://github.com/ruanformigoni/flatimage/\n-   https://github.com/netblue30/firejail\n-   https://github.com/igo95862/bubblejail\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxi%2Fxiwrap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fxi%2Fxiwrap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxi%2Fxiwrap/lists"}