OLLMbwrap.Bubble – ollmchat – Vala Binding Reference

Description:

public class Bubble : Object

Bubble class for executing commands in bubblewrap sandbox.

This class provides secure command execution using bubblewrap (bwrap) to sandbox commands. It creates a read-only root filesystem with read-write access only to specific project directories identified by the project's build_roots() method.

The sandbox configuration: - Mounts the entire filesystem as read-only (--ro-bind / /) unless write_array adds --bind roots - Provides read-write access to project directories via overlay filesystem - Blocks network access by default (--unshare-net, unless allow_network is true) - Executes commands via /bin/sh -c - Provides isolated temporary directory (/tmp) via tmpfs - Mounts /dev read-only (like the rest of the system) with /dev/null writable for output redirection

A new Bubble instance is created for each command execution. The instance is used once and then goes out of scope, so no cleanup logic is needed for old instances.

Environment variables are automatically inherited from the user's environment when using GLib.Subprocess. No explicit --setenv flags are needed.

Overlay filesystem is used for write isolation. All writes to project directories go to the overlay upper directory and are copied back to the live system after command execution completes.

Namespace: OLLMbwrap

Package: ollmchat

Content:

Properties:

public bool allow_network { get; set; }

When false, bwrap uses --unshare-net and seccomp can monitor socket syscalls.

public string bwrap_exe { get; }

Absolute path to the bubblewrap binary, or empty if not found.

public string fail_str { get; }

Accumulator for stderr output (for failure case).

public Overlay overlay { get; }

Overlay for this run; created in ctor, profile synced before exec and build_bubble_args.

public string project_path { get; set; }

Project root path; empty means no-project mode (overlay create/cleanup no-op).

public string ret_str { get; }

Accumulator for stdout output (for success case).

public FileVerification verification { get; construct; }

public HashMap<string,string> write_roots { get; set; }

Writable project root paths for overlay subdirectories.

public string[] write_tokens { get; set; }

Parsed allow_write tokens: no, project, or absolute paths.

Static methods:

public static bool can_wrap ()

Check if bubblewrap can be used for sandboxing.

Creation methods:

Methods:

public string[] build_bubble_args (string command, string working_dir = "") throws Error

Build complete bubblewrap command line arguments.

public bool can_write (string path)

Whether writes to @path are permitted for this sandbox profile. Must match build_bubble_args (bind / overlay / tmpfs / dev-bind).

public async string exec (string command, string working_dir = "") throws Error

Execute command string in bubblewrap sandbox and return output as string.

Inherited Members:

All known members inherited from class GLib.Object

@get
@new
@ref
@set
add_toggle_ref
add_weak_pointer
bind_property
connect
constructed
disconnect
dispose
dup_data
dup_qdata
force_floating
freeze_notify
get_class
get_data

get_property
get_qdata
get_type
getv
interface_find_property
interface_install_property
interface_list_properties
is_floating
new_valist
new_with_properties
newv
notify
notify_property
ref_count
ref_sink
remove_toggle_ref
remove_weak_pointer

replace_data
replace_qdata
set_data
set_data_full
set_property
set_qdata
set_qdata_full
set_valist
setv
steal_data
steal_qdata
thaw_notify
unref
watch_closure
weak_ref
weak_unref

Bubble