diff --git a/README.md b/README.md
index bcb8c45a..c9627d38 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,8 @@ docker run -ti --rm quay.io/devfile/universal-developer-image:ubi9-latest bash
 | `docker`            |`<download.docker.com>`              |
 | `docker-compose`    |`<gh releases>`                      |
 | `kamel`             |`<gh release>`                       |
+|------SANDBOX---------|-------------------------------------|
+| `bubblewrap`        |`v0.11.2 (built from source)`        |
 | **TOTAL SIZE**      | **8.75GB** (3.6GB compressed)       |
 
 **Libraries:**
@@ -263,6 +265,8 @@ docker run -ti --rm quay.io/devfile/universal-developer-image:ubi10-latest bash
 | `skaffold`          |`<latest>`                           |
 | `kamel`             |`v2.8.0`                             |
 | `shellcheck`        |`v0.11.0`                            |
+|------SANDBOX---------|-------------------------------------|
+| `bubblewrap`        |`v0.11.2 (built from source)`        |
 | **TOTAL SIZE**      | **TBD**                             |
 
 **Libraries:**
diff --git a/universal/ubi10/Dockerfile b/universal/ubi10/Dockerfile
index 112e0c4c..d001c4cf 100644
--- a/universal/ubi10/Dockerfile
+++ b/universal/ubi10/Dockerfile
@@ -554,6 +554,34 @@ RUN dnf -y install bash-completion \
     && dnf clean all \
     && rm -rf /var/cache/yum
 
+## bubblewrap - built from source (not available in UBI 10 repos)
+RUN <<'EOF'
+set -euf -o pipefail
+
+TEMP_DIR="$(mktemp -d)"
+cd "${TEMP_DIR}"
+
+BWRAP_VERSION="0.11.2"
+
+dnf -y install libcap-devel
+
+curl -fsSL "https://github.com/containers/bubblewrap/releases/download/v${BWRAP_VERSION}/bubblewrap-${BWRAP_VERSION}.tar.xz" -o bubblewrap.tar.xz
+tar -xf bubblewrap.tar.xz
+cd "bubblewrap-${BWRAP_VERSION}"
+
+printf '#define PACKAGE_STRING "bubblewrap %s"\n' "${BWRAP_VERSION}" > config.h
+gcc -D_GNU_SOURCE -o bwrap bubblewrap.c bind-mount.c network.c utils.c -lcap
+install -m 755 bwrap /usr/local/bin/bwrap
+bwrap --version
+
+cd /
+rm -rf "${TEMP_DIR}"
+
+dnf -y remove libcap-devel
+dnf clean all
+rm -rf /var/cache/yum
+EOF
+
 ## tmux - using pre-built binaries (not available in UBI repos)
 RUN <<'EOF'
 set -euf -o pipefail
diff --git a/universal/ubi9/Dockerfile b/universal/ubi9/Dockerfile
index 543ed9c0..9e1456e7 100644
--- a/universal/ubi9/Dockerfile
+++ b/universal/ubi9/Dockerfile
@@ -521,6 +521,34 @@ RUN dnf -y install bash-completion \
     && dnf clean all \
     && rm -rf /var/cache/yum
 
+## bubblewrap - built from source (not available in UBI 9 repos)
+RUN <<'EOF'
+set -euf -o pipefail
+
+TEMP_DIR="$(mktemp -d)"
+cd "${TEMP_DIR}"
+
+BWRAP_VERSION="0.11.2"
+
+dnf -y install libcap-devel
+
+curl -fsSL "https://github.com/containers/bubblewrap/releases/download/v${BWRAP_VERSION}/bubblewrap-${BWRAP_VERSION}.tar.xz" -o bubblewrap.tar.xz
+tar -xf bubblewrap.tar.xz
+cd "bubblewrap-${BWRAP_VERSION}"
+
+printf '#define PACKAGE_STRING "bubblewrap %s"\n' "${BWRAP_VERSION}" > config.h
+gcc -D_GNU_SOURCE -o bwrap bubblewrap.c bind-mount.c network.c utils.c -lcap
+install -m 755 bwrap /usr/local/bin/bwrap
+bwrap --version
+
+cd /
+rm -rf "${TEMP_DIR}"
+
+dnf -y remove libcap-devel
+dnf clean all
+rm -rf /var/cache/yum
+EOF
+
 ## tmux - using pre-built binaries (not available in UBI repos)
 RUN <<'EOF'
 set -euf -o pipefail