netblue30/firejail on Hacker News

▲ 3

Firejail

story by janalsncm · 2026-05-20 · 2 comments

…security with it is shifted to the user. [1] https://news.ycombinator.com/item?id=22993304 [2] https://github.com/netblue30/firejail/issues/3046

comment by DyslexicAtheist · 2025-08-18 · in SystemD Service Hardening

…https://man.archlinux.org/man/firejail.1 And someone also said, but Firejail supports Landlock, too: https://github.com/netblue30/firejail/pull/6078 .

comment by johnisgood · 2025-03-23 · in Landrun: Sandbox any Linux process using Landlock, no root or containers

Firejail supports Landlock though: https://github.com/netblue30/firejail/pull/6078

comment by ranger_danger · 2025-03-22 · in Landrun: Sandbox any Linux process using Landlock, no root or containers

I've found firejail to be a useful tool for this ( https://github.com/netblue30/firejail ), and additionally use opensnitch ( https://github.com/evilsocket/opensnitch ) to monitor for unexpected network requests. For CI/CD using something…

comment by mnahkies · 2025-03-15 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

Looks like this specific character got fixed. But still a lot of forbidden ones. cf https://github.com/netblue30/firejail/issues/4614 , https://github.com/netblue30/firejail/blob/master/src/fireja... and…

comment by a-french-anon · 2025-02-06 · in NsJail: A light-weight process isolation tool for Linux

…easy to enable. It might even have a github project that people might reach, something like this https://github.com/netblue30/firejail

comment by guappa · 2024-12-02 · in When was the famous "sudo warning" introduced? (2019)

Do you happen to know if the overlayfs bug that upset the firejail developers has been fixed yet? https://github.com/netblue30/firejail/discussions/4178 Perhaps firejail is dead? There's been no releases in 18 months.

comment by smallerfish · 2024-09-27 · in Vanilla OS 2: an immutable distribution to run all software

Firejail is cool: https://github.com/netblue30/firejail Linux namespaces/cgroups but lighter than Docker. I use it when I want to limit the memory of a Python script: ``` maxmem="56" #GB firejail --noprofile --rlimit-as=${maxmem}000000000…

comment by sevagh · 2023-12-02 · in Ask HN: What are some unpopular technologies you wish people knew more about?

…network access (I think?). Migrated from Firejail when its complexity annoyed me too much and I hit https://github.com/netblue30/firejail/issues/3001 (Firejail doesn't like parens or brackets in --put/--get parameters) to a badly NIH…

comment by a-french-anon · 2023-07-12 · in Bubblewrap – Low-level unprivileged sandboxing tool used by Flatpak

…namespaces. For those wondering about their differences, Firejail provides a helpful overview here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-... TL;DR: Firejail has much more comprehensive features than Flatpak…

comment by nateb2022 · 2023-07-11 · in Firejail: Light, featureful and zero-dependency security sandbox for Linux

…running every application in its own firejail (assuming easy to set up) would be pretty sweet. https://github.com/netblue30/firejail/commit/97d8a03cad19501...

comment by smallerfish · 2023-07-11 · in Firejail: Light, featureful and zero-dependency security sandbox for Linux

Firejail does this. The profile database is the two "profile" directories in https://github.com/netblue30/firejail/tree/master/etc

comment by progval · 2023-06-25 · in Try: run a command and inspect its effects before changing your live system

…Downloads directory in home. However, it has a much larger attack surface than bubblewrap [1]. [1] https://github.com/netblue30/firejail/discussions/4522

comment by nextos · 2023-01-27 · in Poll: Do you use anti-virus software on desktop Linux?

…to a unique user or group. [1] - https://ipset.netfilter.org/iptables-extensions.man.html [2] - https://github.com/netblue30/firejail [3] - https://github.com/containers/bubblewrap

comment by LinuxBender · 2022-11-08 · in Microsoft is phoning home the content of PowerPoint slides

…[1] - https://github.com/evilsocket/opensnitch [2] - https://github.com/arkenfox/user.js [3] - https://github.com/netblue30/firejail

comment by LinuxBender · 2022-11-08 · in Ask HN: Reasonable Linux distro that balances security, privacy and usability?

…AppArmor enforcement. [1] - https://addons.mozilla.org/en-US/firefox/addon/temporary-con... [2] - https://github.com/netblue30/firejail

comment by LinuxBender · 2022-09-19 · in Ask HN: Do you browse the web with JavaScript disabled?

That is a somewhat controversial claim. See also this issue page: https://github.com/netblue30/firejail/issues/3046 Also, bubblejail ships all of 8 profiles; I'm skeptical of its claim to be a full replacement.

comment by yjftsjthsd-h · 2022-08-15 · in Breaking all macOS security layers with a single vulnerability

…a sandbox automatically. Or you can create them manually (I did it for the PDF reader and such). https://github.com/netblue30/firejail/

comment by 5e92cb50239222b · 2022-06-21 · in Ask HN: What do you use VMs for regularly?

…command to start containers with root privileges. For more information see [3] and [4]. [1]: https://github.com/netblue30/firejail/issues/1720 [2]: https://wiki.archlinux.org/title/Docker#Installation

comment by seodisparate · 2022-04-27 · in SELinux is unmanageable; just turn it off if it gets in your way

▲ 154

Firejail: Linux namespaces and seccomp-bpf sandbox

story by varbhat · 2022-03-27 · 53 comments

Use firejail, it's a "one click" solution with prepackaged profiles. https://github.com/netblue30/firejail/ It uses the same kernel knobs as systemd does, but is more user-friendly and has more features. I use it for every application that…

comment by 5e92cb50239222b · 2022-01-19 · in Systemd service sandboxing and security hardening (2020)

…you either have to combine `sudo systemd-run` with `su -c`, or wrap the command in firejail. https://github.com/netblue30/firejail/

comment by 5e92cb50239222b · 2022-01-19 · in Systemd service sandboxing and security hardening (2020)

Sort of. For example: https://github.com/netblue30/firejail/issues/1950 There are other, similar issues. It's a fair amount of work sussing it all out.

comment by tyingq · 2021-12-16 · in Secure Containerized Browser

…is firejail, which ships with premade profiles to give things exactly what they need to run, ex. https://github.com/netblue30/firejail/blob/master/etc/profil...

comment by yjftsjthsd-h · 2021-12-16 · in Secure Containerized Browser

…I don't know if the default profile for zoom does that, you have to test it or write your own. [0] https://github.com/netblue30/firejail

comment by the8472 · 2021-08-17 · in Ask HN: Why does Zoom Desktop examine all processes and arguments?

A whitelist/allowlist approach doesn't work for all programs, see this discussion about it: https://github.com/netblue30/firejail/issues/2070

comment by SubzeroCarnage · 2021-07-25 · in When will we get secure desktop OSes? (2018)

…Linux today with two simple commands: - sudo apt/dnf install firejail - sudo firecfg Project: https://github.com/netblue30/firejail Intro Video: https://www.youtube.com/watch?v=N-Mso2bSr3o Disclosure, I am a contributor to firejail. Also…

comment by SubzeroCarnage · 2021-07-25 · in When will we get secure desktop OSes? (2018)

Firejail - https://github.com/netblue30/firejail

comment by quaintdev · 2021-05-20 · in Landlock merged in mainline for Linux 5.13

…Ive seen of this for browser restriction for a session is with running the browser in firejail. https://github.com/netblue30/firejail

comment by codykochmann · 2021-03-26 · in Permission.site

…and systemd unit hardening among other things. Goes well with firejail (am a developer of): https://github.com/netblue30/firejail

comment by SubzeroCarnage · 2021-03-01 · in Spectre exploits in the "wild"

▲ 214

Firejail – Sandbox Linux Applications

story by thushanfernando · 2020-11-10 · 48 comments

…(2018) [2] https://medium.com/hackernoon/im-harvesting-credit-card-numb... (2018) [3] https://github.com/netblue30/firejail/blob/master/README.md

comment by tmerse · 2020-05-13 · in React Native for Windows and Mac

For this job you probably want to use Firejail - https://github.com/netblue30/firejail It's actually more mature for desktop sandboxing then the other solutions because its been effective for years and has a lot of community work on…

comment by WhatIsDukkha · 2020-04-27 · in Mastering systemd: Securing and sandboxing applications and services

…`--app` option removes browser controls, so it almost behaves like an Electron application. [0]: https://github.com/netblue30/firejail

comment by sigwinch28 · 2020-04-13 · in Proof of concept: end-to-end encryption in Jitsi Meet

…https://www.cvedetails.com/vulnerability-list.php?vendor_id=... Also see this thread https://github.com/netblue30/firejail/issues/3046 Instead, we're going to use bubblewrap which is similar but with minimal attack surface. See the…

comment by madaidan · 2020-03-30 · in Fixing the Desktop Linux Security Model

▲ 4

Firejail: Sandboxing on Linux

story by zzbn00 · 2020-01-17 · 0 comments

For developer desktops, there's firejail[1]. [1]: https://github.com/netblue30/firejail

comment by woadwarrior01 · 2019-12-19 · in Linux 3.8 introduced unprivileged user namespaces [pdf]

https://github.com/netblue30/firejail

comment by olejorgenb · 2019-12-04 · in Two malicious Python libraries caught stealing SSH and GPG keys

▲ 1

Firejail: Sandboxing Untrusted Linux Applications

story by als0 · 2019-12-04 · 0 comments

This is what firejail tries to do? https://github.com/netblue30/firejail Anything beyond that, and I think you need qubes-os: https://www.qubes-os.org/

comment by e12e · 2019-03-05 · in Firefox Experiments I Would Have Liked to Try

…in their git repo [1] leaves a bad feeling. [0]: https://www.exploit-db.com/exploits/43359/ [1]: https://github.com/netblue30/firejail/tree/6830065197cc57489...

comment by miduil · 2018-05-11 · in Linux sandboxing improvements in Firefox 60

…1: https://blog.torproject.org/blog/q-and-yawning-angel 2: https://github.com/subgraph/oz 3: https://github.com/netblue30/firejail

comment by splesjaz · 2016-11-30 · in Javascript exploit actively used against TorBrowser

…now uses shared memory and playing audio inside a firejail will break the pulseaudio server: https://github.com/netblue30/firejail/issues/69#issuecomment...

comment by ivank · 2016-04-21 · in Ubuntu 16.04 (Xenial Xerus)