diff --git a/pkgs/tools/admin/bubblewrap/default.nix b/pkgs/tools/admin/bubblewrap/default.nix
new file mode 100644
index 000000000000..5b75657e325a
--- /dev/null
+++ b/pkgs/tools/admin/bubblewrap/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl, libxslt, docbook_xsl, libcap }:
+
+stdenv.mkDerivation rec {
+  name = "bubblewrap-${version}";
+  version = "0.1.8";
+
+  src = fetchurl {
+    url = "https://github.com/projectatomic/bubblewrap/releases/download/v${version}/${name}.tar.xz";
+    sha256 = "1gyy7paqwdrfgxamxya991588ryj9q9c3rhdh31qldqyh9qpy72c";
+  };
+
+  nativeBuildInputs = [ libcap libxslt docbook_xsl ];
+
+  meta = with stdenv.lib; {
+    description = "Unprivileged sandboxing tool";
+    homepage = "https://github.com/projectatomic/bubblewrap";
+    license = licenses.lgpl2Plus;
+    maintainers = with maintainers; [ konimex ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a65f39cb8bcc..f1ffba57a0f3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -722,6 +722,8 @@ with pkgs;
 
   bochs = callPackage ../applications/virtualization/bochs { };
 
+  bubblewrap = callPackage ../tools/admin/bubblewrap { };
+
   borgbackup = callPackage ../tools/backup/borg {
     python3Packages = python34Packages;
   };