Pass --disable-userns to bubblewrap (requires >=0.8.0)

README.md

@@ -10,7 +10,7 @@
 **sandwine** is a command-line tool to run Windows applications on GNU/Linux
 that offers more isolation than raw [Wine](https://www.winehq.org/)
 and more convenience than raw [bubblewrap](https://github.com/containers/bubblewrap).
-It *uses* Wine and bubblewrap, it does not replace them.
+It *uses* Wine and bubblewrap (>=0.8.0), it does not replace them.
 **sandwine** is Software Libre written in Python 3, and
 is licensed under the "GPL v3 or later" license.
 

sandwine/_main.py

@@ -239,6 +239,7 @@ def create_bwrap_argv(config):
 
     argv.add('bwrap')
     argv.add('--new-session')
+    argv.add('--disable-userns')
     argv.add('--die-with-parent')
 
     # Hostname
@@ -407,13 +408,23 @@ def create_bwrap_argv(config):
     return argv
 
 
+def require_recent_bubblewrap():
+    argv = ['bwrap', '--disable-userns', '--help']
+    if subprocess.call(argv, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) != 0:
+        _logger.error('sandwine requires bubblewrap >=0.8.0'
+                      ', aborting.')
+        sys.exit(1)
+
+
 def main():
     exit_code = 0
     try:
         config = parse_command_line(sys.argv[1:])
 
         coloredlogs.install(level=logging.DEBUG)
 
+        require_recent_bubblewrap()
+
         if X11Mode(config.x11) != X11Mode.NONE:
             if X11Mode(config.x11) == X11Mode.AUTO:
                 config.x11 = detect_and_require_nested_x11()