A lightweight SUID sandbox for Linux that uses namespaces, seccomp-bpf, and capabilities to restrict application access.
Firejail is a lightweight SUID sandbox program for Linux that uses kernel security features like namespaces, seccomp-bpf, and capabilities to create restricted environments for running applications. It helps mitigate security risks by isolating processes and limiting their access to system resources, making it suitable for sandboxing servers, graphical apps, and user sessions.
Linux system administrators, security-conscious developers, and users who need to run untrusted applications in isolated environments without heavy virtualization overhead.
Firejail offers a simple, low-overhead sandboxing solution that integrates directly with Linux kernel features, requires no complex configuration or running daemons, and includes pre-built profiles for many common applications.
Linux namespaces and seccomp-bpf sandbox
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses Linux namespaces and seccomp-bpf directly without daemons or complex configs, resulting in minimal performance overhead as stated in the README.
Includes over 900 ready-to-use sandbox configurations for applications like Firefox and VLC, simplifying setup for common use cases.
With firecfg, it automatically sandboxes supported applications in desktop environments, allowing transparent startup from menus and launchers.
Written in C with virtually no dependencies, ensuring compatibility across Linux systems with kernel 3.x or newer, per the README.
Official packages for Debian and Ubuntu are often outdated or vulnerable, forcing manual installation from source or PPAs, as admitted in the installation notes.
As an SUID program, it runs with root privileges, increasing the attack surface if vulnerabilities are present, evidenced by past CVEs like CVE-2021-26910.
Relies entirely on Linux kernel features, making it unusable on other operating systems and dependent on kernel version compatibility.
Custom profile creation is non-trivial, and pre-built profiles have warnings like multiple capabilities in the profile statistics, risking misconfiguration.