Entering an existing sandbox created by bubblewrap without special privileges

[amtlib-dot-dll]

bubblewrap creates namespaces without special privileges, but it can only create new ones. In order to enter those namespaces, nsenter should be run with CAP_SYS_ADMIN.

In the GNOME launcher we an launch new instances of an application. However, the two instances of the application are in two different namespaces, which confuses the application and wastes system resources.

One way is to implement some listener in the running bwrap process with authentication, and when the user requests to launch something new inside the sandbox, launch it.

PS: This would introduce many complex logic, and IMHO C++ may be a better tool for it.

[smtalk]

Nice idea!