Yes, bubblewrap is superior to Docker for this. I wrote a tool to use bubblewrap for the purpose. It needs a tool to start it, or is at least much more convenient with a tool, because you need to take your session/auth data into the container, and if you want the agent to be able to start containers (agents love containers) within the container, you need some config magic mounted inside. You could manually do all that, or do it with a shell script, as well. But, this is how I did it, and you're likely to run into all the same little quirks I ran into:
Interesting. I’ve been trying to use bwrap, slirp4netns, and mitmproxy to create a simple Python script to get save shell for development. But it’s a huge time sink (and I might resort to podman)
When I tried this a month or so ago Linux support was markedly bad, and a quick look at the GitHub issues confirmed it wasn't just me and wasn't a priority for the company. I wouldn't advertise it either.
The nails in the coffin were 1) login was required 2) login was broken because they "didn't consider" it would be run in a headless environment [0] and 3) they shipped with hardcoded binary paths and root requirements [1].
I moved on and use Incus directly with small helper scripts, smolvm, or a full fat VM running desktop Claude or ChatGPT if I (or someone I mentor) really needs the full app. I'm not yoloing every new claw agent in --dangerously-destroy-my-things mode, so network restrictions are best effort, though filesystem access stays tight.
Either way, docker sandboxes really didn't seem to be it, and the company didn't seem interested in trying to be anything beyond an enterprise solution.
(it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)