I don't know if this a bug or a feature, but this thing takes a lot of flexibility out of bubblewrap. It uses setuid syscall to set EUID and SUID to RUID on child, which prevents running child as r...