Abstract

Portable is a sandbox framework targeted for Desktop usage and offers ease of use for distro packagers, which should work on most recent systems:

enables unprivileged user namespaces
uses systemd >=258
has libseccomp >= 2.6
a thread-safe libudev implementation (systemd-udevd is)
has landlock ABI 8 and above (Linux kernel >= 7.0)
Follows the FHS (Filesystem Hierarchy Standard)
- Note that /lib /lib64 /bin /sbin should be symlinks to their respective locations under /usr
Does not have mount points under /usr/bin, and use a supported fs of OverlayFS (NOT BcacheFS)

This is a rewrite of a rewrite of Portable!

For the legacy Go version, see legacy-go branch.
For the original Bash version, see legacy branch.

Portable has companion projects for packaging and sandboxing:

Project	Descripton
Init	Sandbox PID 1 supervisor
StashPak	Build a Portable package for Arch Linux
Packer	Packaging utility for Portable on Arch Linux
Netsock	Network firewall
bawn	CLI for transient sandbox

Why Portable?

See Docs

Available for

Minecraft
Arch Linux
- Arch Linux CN Repository
  - Only selected free/OSS apps
  - Updates faster
- Portable for Arch
  - Configure paru to use portable-arch: https://github.com/Kraftland/portable-arch
  - Current support status (as of 30 Nov 2025): 29 packages in repo.

Limitations:

Running untrusted code is never safe, sandboxing does not change this.
On KDE Plasma window grouping may not work properly unless your desktop file name exactly matches certain arguments.
- This is an KWin issue
Portable acts like Flatpak, to trick XDG Desktop Portal.
- The correct way for this situation is to specify another sandboxing engine in XDP, which I have a PoC here
  - I barely understand C at all! Please help if you will.
- The other possibly "correct way" is to wait until busd#34, and XDP's implementation.
  - Is it dead? idk.

Discuss Development at #portable-dev:matrix.org

Demo

Transient sandbox

See bawn for the successor of Portable Pools.

How to package?

See Docs

FAQ / Troubleshooting

Portable fails with something like invalid argument
- BcacheFS is not supported, or you have mountpoints under /usr/bin and /usr/lib

Starting portable

Start portable with environment variable PORTABLE_CONF, which can be 1) the appID of the sandbox, 2) an absolute path (if exists), 3) a file name interpreted as $(pwd)/${PORTABLE_CONF}. It searches for each of them respectively.

Debugging output can be enabled by building with debug assertions (debug builds).

Debugging

Entering sandbox

To manually execute programs instead of following the exec.target config, start portable with argument --actions debug-shell. This will open a bash prompt and gives you full control of the sandbox environment.

Code of Conduct

Portable and any of its social environment follows the Kraftland Code of Conduct. Please be sure not to violate such rule set.

Version Scheme

Portable follows a major.minor.patch version scheme. We thrives to provide a stable experiences with no breaking changes, however, if said change is necessary, will land in a major release.

The patch release is exclusive for bug fixes. Whereas minor releases contain new features. If a feature or a set of features needs time to test or is important enough, we conduct a major release.

Portable has and always will be only supporting the latest release. Generally users can upgrade without manual intervention, but between major releases it's advised to run systemctl --user stop portable.slice to stop the portable framework.