pipe-wrap creates a rootless Linux sandbox with compatibility targeted at bubblewrap 0.11.x. It is a security boundary only when the kernel, active LSM, user-namespace policy, and requested options all provide that boundary.

Untrusted inputs include command-line arguments, environment operations, filesystem paths, inherited file descriptors, NUL-separated --args streams, seccomp BPF bytes, overlay paths, status/control peers, and the payload process. The host kernel and explicitly installed LSM policy are trusted. Bind sources, namespace FDs, seccomp programs, and capability requests are trusted policy inputs supplied by the caller; pipe-wrap does not make unsafe policy safe.

• Setup errors fail closed unless --not-a-security-boundary explicitly opts into bubblewrap-compatible soft failures.
• All user-supplied FDs are validated before namespace creation; operation-time direction, format, and short-I/O errors remain fatal.
• Mount destinations are created inside the private root and recursive read-only binds remount discovered submounts read-only.
• Capabilities are bounded by the running kernel and dropped according to ordered policy operations.
• Seccomp input must be a complete, bounded classic-BPF program; multiple filters are additive.
• Unrelated inherited FDs are closed before payload execution.
• PID-namespace init reaps descendants and reports the command's authoritative signal/exit outcome.
• Status channels do not authorize setup and reporting failures are surfaced.

Setuid launcher mode, s390x clone ABI handling, and SELinux MCS translation are not implemented. --not-a-security-boundary is unsuitable when isolation is a security requirement. The project does not defend against kernel, filesystem, LSM, or hardware vulnerabilities, nor against a caller deliberately exposing host paths, capabilities, namespace FDs, or permissive seccomp policy.

Portable release gates include strict Clippy, unit tests, deterministic parser mutation tests, dependency advisory checks, an exact reviewed unsafe inventory, reproducible source rebuilds, and packaging checks. Sandbox, pinned-upstream differential, consumer, cgroup, and LSM cells are environment-dependent and count only when their strict preflight succeeds; an unavailable opt-in runner is not evidence that its platform was tested.

Report suspected vulnerabilities through GitHub's private vulnerability reporting for https://github.com/PipeNetwork/pipe-wrap when enabled. Until a dedicated security contact is published, do not send sensitive reports to an invented or third-party address.