Linux: Does bubblewrap require root?

[jacktose]

Additional Info

• I am using Windows Subsystem for Linux

Output of brew config

HOMEBREW_VERSION: 6.0.0
ORIGIN: https://github.com/Homebrew/brew
HEAD: 3d9e344622974a7f96da927fd0407e08581eb437
Last commit: 10 hours ago
Branch: stable
Core tap: N/A
HOMEBREW_PREFIX: /data/shared/lusers/jacktose/homebrew
HOMEBREW_REPOSITORY: /data/shared/lusers/jacktose/homebrew
HOMEBREW_CELLAR: /data/shared/lusers/jacktose/homebrew/Cellar
HOMEBREW_CASK_OPTS: []
HOMEBREW_CLEANUP_MAX_AGE_DAYS: 60
HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS: 7
HOMEBREW_DISPLAY_INSTALL_TIMES: set
HOMEBREW_DOWNLOAD_CONCURRENCY: 8
HOMEBREW_EDITOR: vim
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_FORCE_BREWED_CURL: set
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_GIT_PATH: /usr/local/bin/git
HOMEBREW_MAKE_JOBS: 4
HOMEBREW_NO_SANDBOX_LINUX: set
HOMEBREW_REQUIRE_TAP_TRUST: set
Homebrew Ruby: 4.0.5 => /data/shared/lusers/jacktose/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.5_1/bin/ruby
CPU: quad-core 64-bit broadwell
Clang: N/A
Git: 2.31.1 => /usr/local/bin/git
Curl: 8.15.0 => /data/shared/lusers/jacktose/homebrew/opt/curl/bin/curl
Kernel: Linux 3.10.0-1160.90.1.el7.x86_64 x86_64 GNU/Linux
OS: CentOS Linux release 7.9.2009 (Core) (Core)
Host glibc: 2.17
Host libstdc++: N/A
/usr/bin/gcc: 4.8.5
/usr/bin/ruby: N/A
glibc: 2.39
gcc@13: 15.2.0_1
gcc: 15.2.0_1
xorg: N/A

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Unbrewed header files were found in /usr/local/include.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected header files:
  /usr/local/include/ezs.h
  /usr/local/include/ezsthread.h
  /usr/local/include/node/*
  /usr/local/include/python3.8/*

Warning: Unbrewed '.la' files were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected '.la' files:
  /usr/local/lib/libezs.la

Warning: Unbrewed '.pc' files were found in /usr/local/lib/pkgconfig.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected '.pc' files:
  /usr/local/lib/pkgconfig/python-3.8-embed.pc
  /usr/local/lib/pkgconfig/python-3.8.pc

Warning: Unbrewed static libraries were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected static libraries:
  /usr/local/lib/libezs.a

Warning: Your /home directory is a symlink.
This is known to cause issues with formula linking, particularly when installing
multiple formulae that create symlinks in shared directories.

While this may be a standard directory structure in some distributions
(e.g. Fedora Silverblue) there are known issues as-is.

If you encounter linking issues, you may need to manually create conflicting
directories or use `brew link --overwrite` as a workaround.

We'd welcome a PR to fix this functionality.
See https://github.com/Homebrew/brew/issues/18036 for more context.

This is a Tier 2 configuration:
  https://docs.brew.sh/Support-Tiers#tier-2
You can report issues with Tier 2 configurations to Homebrew/* repositories!
Read the above document before opening any issues or PRs.


Warning: Your system glibc 2.17 is too old.
We will need to automatically install a newer version.

We recommend updating to a newer version via your distribution's
package manager, upgrading your distribution to the latest version,
or changing distributions.

This is a Tier 2 configuration:
  https://docs.brew.sh/Support-Tiers#tier-2
You can report issues with Tier 2 configurations to Homebrew/* repositories!
Read the above document before opening any issues or PRs.


Warning: Your Homebrew's prefix is not /home/linuxbrew/.linuxbrew.

Most of Homebrew's bottles (binary packages) can only be used with the default prefix.
Consider uninstalling Homebrew and reinstalling into the default prefix.

This is a Tier 3 configuration:
  https://docs.brew.sh/Support-Tiers#tier-3
You can report issues with Tier 3 configurations to Homebrew/* repositories!
Read the above document before opening any issues or PRs.


Warning: /usr/bin occurs before /data/shared/lusers/jacktose/homebrew/bin in your PATH.
This means that system-provided programs will be used instead of those
provided by Homebrew. Consider setting your PATH so that
/data/shared/lusers/jacktose/homebrew/bin occurs before /usr/bin. Here is a one-liner:
  echo 'export PATH="/data/shared/lusers/jacktose/homebrew/bin:$PATH"' >> /usr/lusers/jacktose/.bash_profile

The following tools exist at both paths:
  attr
  autopoint
  awk
  bash
  bashbug
  bison
  bunzip2
  bzcat
  bzcmp
  bzdiff
  bzgrep
  bzip2
  bzip2recover
  bzless
  bzmore
  cal
  captoinfo
  chacl
  chmem
  chrt
  clear
  col
  colcrt
  colrm
  column
  compile_et
  corelist
  cpan
  curl
  curl-config
  dmesg
  eject
  envsubst
  fallocate
  findmnt
  flock
  funzip
  gawk
  getfacl
  getfattr
  getopt
  gettext
  gettext.sh
  gettextize
  gfortran
  gss-client
  h2ph
  h2xs
  hexdump
  i386
  infocmp
  infotocap
  instmodsh
  ionice
  ipcmk
  ipcrm
  ipcs
  isosize
  json_pp
  k5srvutil
  kadmin
  kdestroy
  keyctl
  kinit
  klist
  kpasswd
  krb5-config
  ksu
  kswitch
  ktutil
  kvno
  last
  lastb
  ldapadd
  ldapcompare
  ldapdelete
  ldapexop
  ldapmodify
  ldapmodrdn
  ldappasswd
  ldapsearch
  ldapurl
  ldapwhoami
  less
  lesskey
  libnetcfg
  linux32
  linux64
  logger
  look
  lsblk
  lscpu
  lsipc
  lslocks
  lslogins
  lsmem
  lsns
  lz4
  lz4c
  lz4cat
  m4
  make
  mcookie
  mesg
  more
  mount
  mountpoint
  msgattrib
  msgcat
  msgcmp
  msgcomm
  msgconv
  msgen
  msgexec
  msgfilter
  msgfmt
  msggrep
  msginit
  msgmerge
  msgunfmt
  msguniq
  namei
  ngettext
  nsenter
  openssl
  perl
  perlbug
  perldoc
  perlivp
  perlthanks
  piconv
  pkg-config
  pl2pm
  pod2html
  pod2man
  pod2text
  pod2usage
  podchecker
  prlimit
  prove
  ptar
  ptardiff
  ptargrep
  python3
  recode-sr-latin
  rename
  renice
  reset
  rev
  script
  scriptreplay
  setarch
  setfacl
  setfattr
  setsid
  setterm
  shasum
  sim_client
  splain
  sqlite3
  tabs
  taskset
  tic
  toe
  tput
  tset
  tzselect
  ul
  umount
  unlz4
  unshare
  unxz
  unzip
  unzipsfx
  utmpdump
  uuclient
  uuidgen
  wall
  wdctl
  whereis
  whois
  x86_64
  xgettext
  xml2-config
  xmlcatalog
  xmllint
  xmlwf
  xsubpp
  xz
  xzcat
  xzcmp
  xzdec
  xzdiff
  xzegrep
  xzfgrep
  xzgrep
  xzless
  xzmore
  yacc
  zipdetails
  zipgrep
  zipinfo

Warning: Homebrew's "bin" was not found in your PATH.
Consider setting your PATH for example like so:
  echo 'export PATH="/data/shared/lusers/jacktose/homebrew/bin:$PATH"' >> /usr/lusers/jacktose/.bash_profile

Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /data/shared/lusers/jacktose/homebrew/sbin.
Consider setting your PATH for example like so:
  echo 'export PATH="/data/shared/lusers/jacktose/homebrew/sbin:$PATH"' >> /usr/lusers/jacktose/.bash_profile

Description of issue

As of 6.0.0, does all building use bubblewrap by default? Does bubblewrap require root/sudo to work?

I ran brew upgrade bash and was confused to see Error: Bubblewrap is required to use the Linux sandbox but was not found.
(First, should that error provide some better directions to clueless users? Or prompt to automatically install bubblewrap?)

After some reading, I ran brew install bubblewrap (success) and then retried brew upgrade bash, which failed with Error: Bubblewrap is installed but cannot create a rootless sandbox.

I finally had to export HOMEBREW_NO_SANDBOX_LINUX=1 to get anything to build.

Here's a replication of the whole story. I think this'll happen with any invocation that builds from source.

$ brew install hello --build-from-source
==> Would install 1 formula:
hello
==> Would install 2 dependencies for hello:
libcap
bubblewrap
==> Do you want to proceed with the installation? [y/n]
==> Fetching downloads for: hello
✔︎ API Source hello.rb                                                                  Verified      1.7KB/  1.7KB
✔︎ Bottle libcap (2.78)                                                                 Downloaded  123.5KB/123.5KB
✔︎ Bottle bubblewrap (0.11.2)                                                           Downloaded   60.0KB/ 60.0KB
✔︎ Formula hello (2.12.3)                                                               Verified      1.2MB/  1.2MB
Error: Bubblewrap is required to use the Linux sandbox but was not found.

Install Bubblewrap and ensure a rootless `bwrap` executable is available on `PATH`.

As a final workaround, disable the Linux sandbox:
  export HOMEBREW_NO_SANDBOX_LINUX=1

$ brew install bubblewrap
==> Would install 1 formula:
bubblewrap
==> Downloading https://ghcr.io/v2/homebrew/core/bubblewrap/manifests/0.11.2-1
Already downloaded: /usr/lusers/jacktose/.cache/Homebrew/downloads/97ff57229e07324602a0eba13b409a26c238791fb0cdb368f98b93cb47ddfc49--bubblewrap-0.11.2-1.bottle_manifest.json
==> Would install 1 dependency for bubblewrap:
libcap
==> Do you want to proceed with the installation? [y/n]
==> Fetching downloads for: bubblewrap
✔︎ Bottle libcap (2.78)                                                                 Downloaded  123.5KB/123.5KB
✔︎ Bottle bubblewrap (0.11.2)                                                           Downloaded   60.0KB/ 60.0KB
==> Installing bubblewrap dependency: libcap
==> Pouring libcap--2.78.x86_64_linux.bottle.tar.gz
🍺  /data/shared/lusers/jacktose/homebrew/Cellar/libcap/2.78: 103 files, 451.1KB
==> Pouring bubblewrap--0.11.2.x86_64_linux.bottle.1.tar.gz
🍺  /data/shared/lusers/jacktose/homebrew/Cellar/bubblewrap/0.11.2: 10 files, 177.9KB
==> Running `brew cleanup bubblewrap`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> Installation times
libcap                    1.217 s
bubblewrap                2.997 s

$ brew install hello --build-from-source
==> Would install 1 formula:
hello
==> Fetching downloads for: hello
✔︎ API Source hello.rb                                                                  Verified      1.7KB/  1.7KB
✔︎ Formula hello (2.12.3)                                                               Verified      1.2MB/  1.2MB
Error: Bubblewrap is installed but cannot create a rootless sandbox.

Homebrew's Linux sandbox requires rootless Bubblewrap and unprivileged
user namespaces. Check and update this system configuration:
  sudo sysctl -w kernel.unprivileged_userns_clone=1
    Allows unprivileged processes to create user namespaces. Rootless
    Bubblewrap needs this to isolate builds without elevated privileges.
  sudo sysctl -w user.max_user_namespaces=28633
    Allows each user to allocate enough user namespaces. A zero or low
    limit can prevent Bubblewrap from creating its sandbox.
  sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
    Allows unprivileged user namespaces on AppArmor-enabled systems
    that restrict them by default. Older kernels may not provide this
    setting.

As a final workaround, disable the Linux sandbox:
  export HOMEBREW_NO_SANDBOX_LINUX=1

$ export HOMEBREW_NO_SANDBOX_LINUX=1

$ brew install hello --build-from-source
==> Would install 1 formula:
hello
==> Fetching downloads for: hello
✔︎ API Source hello.rb                                                                  Verified      1.7KB/  1.7KB
✔︎ Formula hello (2.12.3)                                                               Verified      1.2MB/  1.2MB
==> ./configure --disable-silent-rules
==> make install
🍺  /data/shared/lusers/jacktose/homebrew/Cellar/hello/2.12.3: 57 files, 341.0KB, built in 39 seconds
==> Running `brew cleanup hello`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> Installation times
hello                    39.864 s

The sandbox sounds like a good idea. Is there a way to get it working on a machine where I don't have root? Or must I just keep HOMEBREW_NO_SANDBOX_LINUX forever?

[SMillerDev]

Unfortunately it is not possible to get bubblewrap to work without running those commands as root once, because they allow bubblewrap to do it's thing.

[jacktose]

Thanks, that's the simple answer. I'll just set HOMEBREW_NO_SANDBOX_LINUX permanently on the machines where I don't have root.

(I'll continue with the UX question in the other thread, though.)

[SMillerDev]

I ran brew upgrade bash and was confused to see Error: Bubblewrap is required to use the Linux sandbox but was not found.
(First, should that error provide some better directions to clueless users? Or prompt to automatically install bubblewrap?)

That should be fixed in Homebrew 6.0.1, could you try again?

[jacktose]

I guess not? This looks the same to me:

$ brew --version
Homebrew 6.0.1

$ brew install hello --build-from-source
==> Would install 1 formula:
hello
==> Would install 2 dependencies for hello:
libcap
bubblewrap
==> Do you want to proceed with the installation? [y/n]
==> Fetching downloads for: hello
✔︎ API Source hello.rb                                                                 Verified      1.7KB/  1.7KB
✔︎ Bottle bubblewrap (0.11.2)                                                          Downloaded   60.0KB/ 60.0KB
✔︎ Bottle libcap (2.78)                                                                Downloaded  123.5KB/123.5KB
✔︎ Formula hello (2.12.3)                                                              Verified      1.2MB/  1.2MB
Error: Bubblewrap is required to use the Linux sandbox but was not found.

Install Bubblewrap and ensure a rootless `bwrap` executable is available on `PATH`.

As a final workaround, disable the Linux sandbox:
  export HOMEBREW_NO_SANDBOX_LINUX=1

Am I reading that right? It's planning to install bubblewrap (& deps) but failing because it doesn't have bubblewrap?

[jacktose]

Here's a replication on a cleaner (WSL) machine:

brew config output

HOMEBREW_VERSION: 6.0.1
ORIGIN: https://github.com/Homebrew/brew
HEAD: 109191be4988470b51a60a5ef1998520aa24c01b
Last commit: 29 hours ago
Branch: stable
Core tap: N/A
HOMEBREW_PREFIX: /home/linuxbrew/.linuxbrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: :0
HOMEBREW_DISPLAY_INSTALL_TIMES: set
HOMEBREW_DOWNLOAD_CONCURRENCY: 40
HOMEBREW_EDITOR: vim
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 20
HOMEBREW_REQUIRE_TAP_TRUST: set
Homebrew Ruby: 4.0.5 => /home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/portable-ruby/4.0.5_1/bin/ruby
CPU: 20-core 64-bit alderlake
Clang: N/A
Git: 2.43.0 => /bin/git
Curl: 8.5.0 => /bin/curl
Kernel: Linux 6.18.33.1-microsoft-standard-WSL2 x86_64 GNU/Linux
OS: Ubuntu 24.04.4 LTS (noble)
WSL: 2 (Microsoft Store)
Host glibc: 2.39
Host libstdc++: 6.0.33
/usr/bin/gcc-13: 13.3.0
/usr/bin/ruby: N/A
glibc: N/A
gcc@13: N/A
gcc: N/A
xorg: N/A

brew doctor output

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Bubblewrap is required to use the Linux sandbox but was not found.

Install Bubblewrap and ensure a rootless `bwrap` executable is available on `PATH`.

As a final workaround, disable the Linux sandbox:
  export HOMEBREW_NO_SANDBOX_LINUX=1

$ brew install hello --build-from-source
==> Would install 1 formula:
hello
==> Would install 2 dependencies for hello:
libcap
bubblewrap
==> Do you want to proceed with the installation? [y/n]
==> Fetching downloads for: hello
✔︎ API Source hello.rb                                                                       Verified      1.7KB/  1.7KB
✔︎ Bottle Manifest libcap (2.78)                                                             Downloaded    3.5KB/  3.5KB
✔︎ Bottle libcap (2.78)                                                                      Downloaded  123.5KB/123.5KB
✔︎ Bottle Manifest bubblewrap (0.11.2)                                                       Downloaded    3.6KB/  3.6KB
✔︎ Bottle bubblewrap (0.11.2)                                                                Downloaded   60.0KB/ 60.0KB
✔︎ Formula hello (2.12.3)                                                                    Verified      1.2MB/  1.2MB
Error: Bubblewrap is required to use the Linux sandbox but was not found.

Install Bubblewrap and ensure a rootless `bwrap` executable is available on `PATH`.

As a final workaround, disable the Linux sandbox:
  export HOMEBREW_NO_SANDBOX_LINUX=1