netblue30
firejail
C2016–2026
netblue30 / firejail
firejail
Linux namespaces and seccomp-bpf sandbox
36Distinct people
44Mentions
0Explicit recommenders
7.7KGitHub stars
What to know before exploring
What it is
Linux namespaces and seccomp-bpf sandbox
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- evilsocket/opensnitch · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year44 dated mentions
Observed mentions: 2016-04-21 12:53:43 UTC to 2026-05-20 20:09:13 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 9 | 1 | 8 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 1 | 0 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Firejail
Firejail is a lightweight security tool intended to protect a Linux system by
setting up a restricted environment for running (potentially untrusted)
applications.
More specifically, it is an SUID sandbox program that reduces the risk of
security breaches by using Linux namespaces, seccomp-bpf and Linux
capabilities. It allows a process and all its descendants to have their own
private view of the globally shared kernel resources, such as the network
stack, process table and mount table. Firejail can work in an SELinux or
AppArmor environment, and it is integrated with Linux Control Groups.
Written in C with virtually no dependencies, the software runs on any Linux
computer with a 3.x kernel version or newer. It can sandbox any type of
processes: servers, graphical applications, and even user login sessions. The
software includes sandbox profiles for a number of more common Linux programs,
such as Mozilla Firefox, Chromium, VLC, Transmission etc.
The sandbox is lightweight, the overhead is low. There are no complicated
configuration files to edit, no socket connections open, no daemons running in
the background. All security features are implemented directly in Linux kernel
and available on any Linux computer.
Videos
Quick Start
Advanced Browser Security
Tor Browser Security
Links
Project webpage: https://firejail.wordpress.com/
IRC: https://web.libera.chat/#firejail
Download and Installation: https://firejail.wordpress.com/download-2/
Features: https://firejail.wordpress.com/features-3/
Documentation: https://firejail.wordpress.com/documentation-2/
FAQ: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions
Wiki: https://github.com/netblue30/firejail/wiki
GitHub Actions: https://github.com/netblue30/firejail/actions
GitLab CI: https://gitlab.com/Firejail/firejail_ci/pipelines
Debian CI: https://salsa.debian.org/reiner/firejail
Debian Package Tracker: https://tracker.debian.org/pkg/firejail
Ubuntu PPA: https://launchpad.net/~deki/+archive/ubuntu/firejail
Video Channel: https://odysee.com/@netblue30:9?order=new
Backup Video Channel: https://www.bitchute.com/profile/JSBsA1aoQVfW/
Security vulnerabilities
See SECURITY.md.
Installing
For the supported versions, see SECURITY.md.
Debian
Note: The versions from Debian stable and backports are likely to be outdated,
so currently we recommend either downloading and installing the .deb package
from the latest release:
https://github.com/netblue30/firejail/releases/latest
Or building from source.
Old instructions
Debian stable (bullseye): We recommend to use the
backports package.
Ubuntu
Note: The versions from the distribution and PPA are likely to be outdated, so
currently we recommend either downloading and installing the .deb package from
the latest release:
https://github.com/netblue30/firejail/releases/latest
Or building from source.
Old instructions
Note: The PPA recommendation is mainly for firejail itself; it should be fine
to install firetools and firejail-related tools directly from the distribution
if they are not in the PPA as they tend to be updated less frequently.
For Ubuntu 18.04+ and derivatives (such as Linux Mint), users are strongly
advised to use the
PPA.
How to add and install from the PPA:
sudo add-apt-repository ppa:deki/firejail
sudo apt-get update
sudo apt-get install firejail firejail-profiles
Reason: The firejail package for Ubuntu 20.04 has been left vulnerable to
CVE-2021-26910 for months after a patch for it was posted on Launchpad:
CVE-2021-26910
firejail version in Ubuntu 20.04 LTS is vulnerable to
CVE-2021-26910
See also https://wiki.ubuntu.com/SecurityTeam/FAQ:
What software is supported by the Ubuntu Security team?
Ubuntu is currently divided into four components: main, restricted, universe
and multiverse. All binary packages in main and restricted are supported by
the Ubuntu Security team for the life of an Ubuntu release, while binary
packages in universe and multiverse are supported by the Ubuntu community.
Additionally, the PPA version is likely to be more recent and to contain more
profile fixes.
See the following discussions for details:
Should I keep using the version of firejail available in my distro
repos?
How to install the latest version on Ubuntu and
derivatives
Other
Firejail is available in multiple Linux distributions:
Repology
Other than the aforementioned exceptions, as long as your
distribution provides a supported version of firejail, it's
generally a good idea to install it from the distribution.
The version can be checked with firejail --version after installing.
You can also install one of the released
packages.
Building
Instructions for building and installing the current development version from
source.
It is recommended to use the distribution-specific instructions below when
applicable, as they generate native packages, which should make integration
with the rest of the system and package management easier.
For other distributions, see the generic instructions.
See also .gitlab-ci.yml for how distribution-specific builds
are done in CI.
Arch
Note: The AUR package is not maintained by us.
Install firejail-git from
the AUR.
Example:
yay -S firejail-git
Debian
For Debian, Ubuntu and derivatives:
Note: Any ./configure flags should be passed to mkdeb.sh
(such as ./mkdeb.sh --enable-foo).
sudo apt-get update -qy
sudo apt-get install -qy \
git build-essential fakeroot lintian libapparmor-dev pkg-config gawk
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./mkdeb.sh &&
sudo dpkg -i ./*.deb &&
make installcheck
Fedora
For Fedora and derivatives:
Note: Any ./configure flags should be passed to mkrpm.sh
(such as ./platform/rpm/mkrpm.sh --enable-foo).
sudo dnf update -y
sudo dnf install -y rpm-build gcc make
git clone 'https://github.com/netblue30/firejail.git' &&
cd firejail &&
./configure &&
make dist &&
./platform/rpm/mkrpm.sh &&
sudo rpm -i ./*.rpm &&
make in
Read the full README on GitHubWhat Hacker News says
44 sourcesthese Hardening variables have been discussed some years back[1].
this will not take off I'm afraid, because locking these unitfiles down is offloaded to the end-user (I've yet to see maintainers embrace shipping locked down files). Maybe they will? But this same approach hasn't worked with apparmor so why should it work with systemd? Who will do the job?
If you consider apparmor maintainers provide skeleton-templates in many cases that will make the parser stop complaining. ("look I have a profile so apparmor shuts up, but don't take too close a look OK")
Then there is firejail, which some argue[2] is snake-oil considering the high level of administrative glue compared to its massive attack-surface (also it's a setuid binary).
I didn't mention SElinux since I don't know a single person who had the joy (or pain depending on perspective) o
Read the rest
f working with it. But again, seems the expectation to implement security with it is shifted to the user.
[1] https://news.ycombinator.com/item?id=22993304
[2] https://github.com/netblue30/firejail/issues/3046
I will just leave this here: https://man.archlinux.org/man/firejail.1
And someone also said, but Firejail supports Landlock, too: https://github.com/netblue30/firejail/pull/6078.
In Landrun: Sandbox any Linux process using Landlock, no root or containersFirejail supports Landlock though: https://github.com/netblue30/firejail/pull/6078
In Landrun: Sandbox any Linux process using Landlock, no root or containersI've found firejail to be a useful tool for this (https://github.com/netblue30/firejail), and additionally use opensnitch (https://github.com/evilsocket/opensnitch) to monitor for unexpected network requests.
For CI/CD using something like ArgoCD let's you avoid giving CI direct access to prod - it still needs write access to a git repo, and ideally some read access to Argo to check if deployment succeeded but it limits the surface area.
In Tj-actions/changed-files GitHub Action Compromised – used by over 23K reposLooks like this specific character got fixed. But still a lot of forbidden ones.
cf https://github.com/netblue30/firejail/issues/4614, https://github.com/netblue30/firejail/blob/master/src/fireja... and https://github.com/netblue30/firejail/blob/master/src/lib/co...
In NsJail: A light-weight process isolation tool for LinuxIf only firejail existed to do exactly that… it could come packaged in most distributions with sensible profiles that are easy to enable.
It might even have a github project that people might reach, something like this https://github.com/netblue30/firejail
In When was the famous "sudo warning" introduced? (2019)Do you happen to know if the overlayfs bug that upset the firejail developers has been fixed yet? https://github.com/netblue30/firejail/discussions/4178
Perhaps firejail is dead? There's been no releases in 18 months.
In Vanilla OS 2: an immutable distribution to run all softwareFirejail is cool: https://github.com/netblue30/firejail
Linux namespaces/cgroups but lighter than Docker.
I use it when I want to limit the memory of a Python script:
```
maxmem="56" #GB
firejail --noprofile --rlimit-as=${maxmem}000000000 python myscript.py
```
In Ask HN: What are some unpopular technologies you wish people knew more about?Wonderful little tool, too bad you must chain various exec calling tools to get cgroups (a bit akin to `ionice ... nice ... cmd`) and Linux users namespaces can't allow UNIX sockets while preventing network access (I think?).
Migrated from Firejail when its complexity annoyed me too much and I hit https://github.com/netblue30/firejail/issues/3001 (Firejail doesn't like parens or brackets in --put/--get parameters) to a badly NIH version using bwrap and bash to have "profiles":
https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap_aut...
https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap_eas...
PS: strace is your best friend when trying to make bwrap profiles
In Bubblewrap – Low-level unprivileged sandboxing tool used by FlatpakFirejail, Flatpak (which uses Bubblewrap under the hood), and Snap (which uses AppArmor) all use the same underlying technology: Linux namespaces.
For those wondering about their differences, Firejail provides a helpful overview here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-...
TL;DR: Firejail has much more comprehensive features than Flatpak (Bubblewrap). Firejail also has more comprehensive network support, support for AppArmor and SELinux, and easier seccomp filtering.
Compared to Snap (which uses AppArmor), Firejail is not only compatible with AppArmor but again goes above and beyond with a lot of additional features.
In Firejail: Light, featureful and zero-dependency security sandbox for LinuxLast time I tried this, the overlayfs was disabled in response to a CVE. Once that's re-enabled, I do think this could be a useful tool with some better wrappers; running every application in its own firejail (assuming easy to set up) would be pretty sweet.
https://github.com/netblue30/firejail/commit/97d8a03cad19501...
In Firejail: Light, featureful and zero-dependency security sandbox for LinuxFirejail does this. The profile database is the two "profile" directories in https://github.com/netblue30/firejail/tree/master/etc
In Try: run a command and inspect its effects before changing your live systemYes, I agree flatpak is a bad way of packaging. Note, bubblewrap is independent of flatpak.
In fact there are some proposals to add sandboxing to nix, which is the antithesis of flatpak, using bubblewrap.
Firejail is a more usable alternative and comes with very sane default rules, e.g. only allow Firefox to see the Downloads directory in home.
However, it has a much larger attack surface than bubblewrap [1].
[1] https://github.com/netblue30/firejail/discussions/4522
In Poll: Do you use anti-virus software on desktop Linux?The owner module can control outbound communication by uid/gid. [1] There are no modules to handle things by PID AFAIK. This can however be accomplished by SELinux and Apparmor custom rules but that is a loaded topic.
Firejail [2] and Bubblewrap [3] can put limits on application capabilities and/or take away network access. Firejail has default policies for many applications, all of which can be overridden by user configurations in their home directory. Firejail leverages Linux Capabilities and AppArmor. For example, when I launch VLC even if it were configured to pull down album information, it could not. If one day they added default-enabled telemetry to VLC it would go nowhere.
A round-about and heavy handed way to manage communications by PID would be to isolation applications in their own VM or container and map the VM or conta
Read the rest
iner to a unique user or group.
[1] - https://ipset.netfilter.org/iptables-extensions.man.html
[2] - https://github.com/netblue30/firejail
[3] - https://github.com/containers/bubblewrap
Showing the 15 most recent of 44 sources. Enable JavaScript to search and browse every indexed mention.