firejail

application sandboxing with Linux namespaces

TLDR

Run a program inside a sandbox using its default security profile

$ firejail [program]

Give the sandbox a name you can refer to later

$ firejail --name=[web] [firefox]

Show a process tree of everything currently sandboxed

$ firejail --tree

Watch sandbox resource usage, top-style

$ firejail --top

Attach a shell to a running sandbox

$ firejail --join=[web]

Deny the sandbox any network access

$ firejail --net=none [program]

Give the program a throwaway home directory

$ firejail --private [program]

Expose only specific paths from the real home directory

$ firejail --whitelist=[~/Documents] [program]

Mount a path read-only inside the sandbox

$ firejail --read-only=[~/.ssh] [program]

Block sound and 3D acceleration

$ firejail --nosound --no3d [program]

Terminate a sandbox by name or PID

$ firejail --shutdown=[web]

$ sudo firecfg

SYNOPSIS

firejail [options] [program] [arguments]

firejail securely sandboxes processes using Linux namespaces, seccomp-bpf, and capabilities. It isolates applications from the rest of the system for security.Provides per-application profiles for common programs like Firefox and VLC.

PARAMETERS

--list

List running sandboxes

--netstats

Show network activity

--shutdown pid

Stop sandbox by PID

--net interface

Use network namespace

--ip address

Assign IP address

--seccomp

Enable seccomp filtering

--private

Use private home directory

--private-tmp

Use private /tmp

--private-dev

Use private /dev

CONFIGURATION

/etc/firejail/[application].profile

Application-specific sandboxing profiles defining restrictions and permissions.

~/.config/firejail/[application].profile

User-level custom profiles that override system defaults.

INSTALL

sudo apt install firejail

sudo dnf install firejail

sudo pacman -S firejail

sudo zypper install firejail

nix profile install nixpkgs#firejail

CAVEATS

Some applications may not work correctly in sandbox. Profiles in /etc/firejail/. Use firecfg to integrate with desktop.

RESOURCES

Source code