Hacker News Reader

I think this is just a comment on Firejail's implementation, as I think Firejail runs as root and thus must enforce its own permission checks.

It seems like bubblewrap uses a mount namespace created by the current user which would allow controlling access without any special checks.

I'm running firejail now and It doesn't look like it runs as root.

Correct, it is an SUID executable[0], as is bubblewrap.

This is poorly documented, but if the kernel supports unprivileged user namespaces, bubblewrap works without suid.

Good to know, thanks.

Does/can firejail, or is that a difference?

bubblewrap is only setuid if user namespaces are unavailable.