Remove Bubblewrap, use Landlock for Linux sandbox

[MikeMcQuaid]

• Landlock needs no separate executable, installation or sysctl configuration, so use it as the only Linux sandbox implementation rather than an opt-in behind $HOMEBREW_SANDBOX_LINUX_LANDLOCK.
• Delete Sandbox::Bubblewrap, the brew setup-sandbox command and the implicit bubblewrap dependency, none of which Landlock needs.
• Remove the Bubblewrap-era Sandbox API (ensure_sandbox_installed!, configure!, configuration_commands, sandbox_install_command) and its call sites now that no backend needs installing or configuring.
• Simplify brew doctor's check_linux_sandbox to report the Landlock failure reason with the $HOMEBREW_NO_SANDBOX_LINUX workaround.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Fable 5 max with local review and (unit) testing.

---

[Copilot]

Pull request overview

This pull request removes Bubblewrap-based Linux sandboxing from Homebrew and makes Landlock the sole Linux sandbox backend, eliminating the need for a separate install/configuration step and simplifying the Sandbox API and related diagnostics.

Changes:

• Delete the Bubblewrap backend and the brew setup-sandbox command, removing associated docs/completions/tests and Bubblewrap-specific dependency logic.
• Simplify the Linux Sandbox implementation and call sites to always use Landlock (and drop the Bubblewrap-era install/configure API surface).
• Update brew doctor Linux sandbox messaging to report the Landlock failure reason and suggest $HOMEBREW_NO_SANDBOX_LINUX as the workaround.

Reviewed changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
manpages/brew.1	Removes setup-sandbox from the manpage.
Library/Homebrew/test/sandbox_shared_spec.rb	Updates shared sandbox stubs for removed install/configure APIs.
Library/Homebrew/test/sandbox_linux_spec.rb	Removes Bubblewrap-focused specs; keeps Linux sandbox run coverage.
Library/Homebrew/test/sandbox_landlock_spec.rb	Removes Landlock “configure” expectations tied to deleted APIs.
Library/Homebrew/test/os/linux/diagnostic_spec.rb	Updates brew doctor expectations from Bubblewrap to Landlock.
Library/Homebrew/test/os/linux/dependency_collector_spec.rb	Removes Bubblewrap implicit-dep coverage from Linux dependency collector tests.
Library/Homebrew/test/github_runner_matrix_spec.rb	Updates runner matrix expectations (no longer sets Landlock opt-in env).
Library/Homebrew/test/formula_installer_spec.rb	Removes Bubblewrap cyclic-dependency special-casing specs; updates sandbox stubs.
Library/Homebrew/test/dev-cmd/tests_spec.rb	Updates test-environment checks for the simplified sandbox model.
Library/Homebrew/test/cmd/setup-sandbox_spec.rb	Deletes tests for removed setup-sandbox command/script.
Library/Homebrew/test/cask/artifact/generated_completion_spec.rb	Updates Sandbox stubbing for removed install/configure APIs.
Library/Homebrew/test/bundle/installer_spec.rb	Updates implicit dependency fixture away from Bubblewrap.
Library/Homebrew/test/bash_spec.rb	Removes bash-level test asserting Landlock selection via env.
Library/Homebrew/sorbet/rbi/dsl/homebrew/cmd/setup_sandbox.rbi	Deletes RBI for removed Homebrew::Cmd::SetupSandbox.
Library/Homebrew/sandbox.rb	Removes Bubblewrap-era install/configure API hooks and relies on availability checks.
Library/Homebrew/json_api_postinstall_preflight_postflight_plan.md	Updates documentation text from Bubblewrap to Landlock.
Library/Homebrew/github_runner_matrix.rb	Removes Landlock opt-in env from Linux container options.
Library/Homebrew/formula_installer.rb	Removes Bubblewrap-specific cyclic-dependency and state-reset logic.
Library/Homebrew/extend/os/linux/test_bot.rb	Drops sandbox configuration step; now only checks availability.
Library/Homebrew/extend/os/linux/sandbox/landlock.rb	Removes Bubblewrap-era API surface/comments; keeps Landlock as backend.
Library/Homebrew/extend/os/linux/sandbox/bubblewrap.rb	Deletes Bubblewrap backend implementation.
Library/Homebrew/extend/os/linux/sandbox.rb	Removes backend-selection logic; wires Linux Sandbox directly to Landlock.
Library/Homebrew/extend/os/linux/formula.rb	Removes Bubblewrap implicit global dependency injection.
Library/Homebrew/extend/os/linux/diagnostic.rb	Simplifies Linux sandbox brew doctor finding to Landlock-focused messaging.
Library/Homebrew/extend/os/linux/dev-cmd/tests.rb	Simplifies Linux test-environment sandbox checks to availability-only.
Library/Homebrew/extend/os/linux/dependency_collector.rb	Removes Bubblewrap implicit dependency logic and related global dep-tree handling.
Library/Homebrew/env_config.rb	Updates sandbox env var description from Bubblewrap to Landlock.
Library/Homebrew/dev-cmd/test.rb	Removes explicit “ensure sandbox installed” call before testing.
Library/Homebrew/dependency_collector.rb	Removes Bubblewrap from implicit dependency collection.
Library/Homebrew/cmd/setup-sandbox.sh	Deletes the Bubblewrap/sysctl setup script.
Library/Homebrew/cmd/setup-sandbox.rb	Deletes the setup-sandbox Ruby command definition.
Library/Homebrew/cask/artifact/abstract_artifact.rb	Removes sandbox install step; relies on availability.
Library/Homebrew/brew.sh	Removes exporting the Landlock opt-in env var for self-hosted runners.
docs/Manpage.md	Removes setup-sandbox documentation.
completions/zsh/_brew	Removes setup-sandbox zsh completion entries.
completions/internal_commands_list.txt	Removes setup-sandbox from internal commands list.
completions/fish/brew.fish	Removes setup-sandbox fish completion entries.
completions/bash/brew	Removes setup-sandbox bash completion entries.

Files not reviewed (1)

• Library/Homebrew/sorbet/rbi/dsl/homebrew/cmd/setup_sandbox.rbi: File type not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.