Firejail

Firejail is a Linux sandboxing utility designed to isolate running applications from the rest of the system. It achieves this by leveraging kernel security features such as namespaces, seccomp-bpf, and capabilities dropping to reduce the potential impact of software compromise.

Firejail runs a program inside a sandbox that provides separate namespaces for process trees, mount points, network, and IPC. It can mount a private filesystem view, restrict network access, and drop unnecessary privileges. Optional integration with AppArmor or SELinux enhances confinement. The project emphasizes profile-driven restrictions and supports unprivileged sandboxing on kernels that enable user namespaces.

Profiles tailor restrictions for individual applications. Profiles are included with Firejail and may be extended or overridden by user-created rules, typically found under /etc/firejail and /usr/share/firejail. Common usage involves launching a target program within a sandbox, such as a web browser, with options to limit filesystem access or networking (for example, using a private home directory or disabling network access). Firejail can also be used to isolate sandboxes from each other and from the user’s normal environment.

Firejail is open-source software released under the GNU General Public License and is available in many Linux distributions via standard package managers. It is intended as a defense-in-depth measure rather than a complete replacement for other security controls. Users should ensure kernel features and profiles are appropriate for their environment.