What does HackerNews think of firejail?

Firejail [2] and Bubblewrap [3] can put limits on application capabilities and/or take away network access. Firejail has default policies for many applications, all of which can be overridden by user configurations in their home directory. Firejail leverages Linux Capabilities and AppArmor. For example, when I launch VLC even if it were configured to pull down album information, it could not. If one day they added default-enabled telemetry to VLC it would go nowhere.

A round-about and heavy handed way to manage communications by PID would be to isolation applications in their own VM or container and map the VM or container to a unique user or group.

[1] - https://ipset.netfilter.org/iptables-extensions.man.html

[2] - https://github.com/netblue30/firejail

[3] - https://github.com/containers/bubblewrap

Some of its more interesting features (in addition to the obvious path/privilege restrictions):

- putting the application into a separate network namespace with its own firewall rules/network interfaces (for example, you can force Firefox to work through a VPN connection only, or block incoming connections with your main firewall rules and allow them for a single application)

- using a separate X server for each application (works pretty much transparently)

- setting resource limits (network bandwidth, memory, CPU, I/O; although not as flexible as systemd limits, they can be combined)

- running `sudo firecfg` once will create a bunch of symlinks for all applications installed on your system and supported by firejail. After that, those applications will run under a sandbox automatically. Or you can create them manually (I did it for the PDF reader and such).

https://github.com/netblue30/firejail/

https://github.com/netblue30/firejail/

It uses the same kernel knobs as systemd does, but is more user-friendly and has more features.

I use it for every application that handles data received from other machines: books, images, documents, whatever.

Supports Fedora, Arch, Debian, and openSUSE.

Has GNOME, Firefox, kernel cmdline, sysctl, firewalld, NetworkManager, and systemd unit hardening among other things.

Goes well with firejail (am a developer of): https://github.com/netblue30/firejail

https://github.com/netblue30/firejail

It's actually more mature for desktop sandboxing then the other solutions because its been effective for years and has a lot of community work on sandboxing -

https://github.com/chiraag-nataraj/firejail-profiles

If you want to use a prepackaged application vs sandboxing a new app or something in your distribution you should go with -

https://flathub.org/home

Not every app is well sandboxed with flatpak but this is the goal and they are making very good progress. Also a great way to track a larger project that your distribution doesn't keep up to date as you'd like.

just to note -- flatpak/flathub use bubblewrap under the covers which is very promising but I don't see the community profiles like firejail yet.

I am mainly a Firefox user on NixOS, but for running Chrom{e,ium} I find that Firejail [0] is a good option. For example, to run chromium in "store" mode and point it to the demo jitsi instance:

    firejail --profile=chromium chromium --app="https://meet.jit.si"

    nix-shell -p chromium --run "firejail --profile=chromium chromium --app=\"https://meet.jit.si\""

[0]: https://github.com/netblue30/firejail

[1]: https://github.com/netblue30/firejail

https://github.com/netblue30/firejail

Anything beyond that, and I think you need qubes-os:

https://www.qubes-os.org/

1: https://blog.torproject.org/blog/q-and-yawning-angel 2: https://github.com/subgraph/oz 3: https://github.com/netblue30/firejail