Why this package wraps Gety in a bubblewrap sandbox
The upstream .deb installs its helpers (deno, aria2c, mcp-proxy) into system /usr/bin, which we refuse to pollute.
They live in /usr/lib/Gety/bin instead; a read-only-root bwrap sandbox recreates the layout Gety expects via PATH + /usr/bin overlays.
- Not a strong isolation boundary, Treat it as defense-in-depth, not a firewall.
- Name stays
-bin: if upstream ever fixes its packaging, the wrapper can simply go away.
Pinned Comments
Alex3236 commented on 2026-09-06 08:18 (UTC) (edited on 2026-09-06 08:18 (UTC) by Alex3236)
Why this package wraps Gety in a bubblewrap sandbox
The upstream .deb installs its helpers (deno, aria2c, mcp-proxy) into system /usr/bin, which we refuse to pollute.
They live in /usr/lib/Gety/bin instead; a read-only-root bwrap sandbox recreates the layout Gety expects via PATH + /usr/bin overlays.
-bin: if upstream ever fixes its packaging, the wrapper can simply go away.