Alternatives to Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.
Replacements
Listings that take over the same core job as Firejail.
Bubblewrap
A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.
Bubblewrap sandboxes Linux programs without root or SUID under LGPL-2.0-or-later, but it is low-level with no preset profiles, so every sandbox must be configured by hand.
AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles.
AppArmor is a kernel security module that confines programs through per-application profiles, and writing and tuning those profiles takes time and testing.
SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.
SELinux provides kernel-enforced mandatory access control shipped by Linux distributions, with a steeper learning curve for writing and debugging policy.
gVisor
An application kernel that sandboxes containers to isolate them from the host Linux kernel.
gVisor is an Apache-2.0 application kernel that isolates containers from the host Linux kernel through the runsc runtime, suited to containers rather than confining desktop applications.
Also worth comparing
These listings name Firejail as their own alternative, so the relationship runs both ways.
Sandboxie-Plus
Runs a Windows program inside an isolated box, so whatever it writes to disk or the registry disappears afterwards.
Firejail moves you to Linux, confining existing applications with namespaces and seccomp-bpf, and it runs as a SUID program that some users consider a risk.
Similar software
Related functionality, not a direct replacement.
Flatseal
A graphical utility for reviewing and changing the permissions of installed Flatpak applications.
Qubes OS
Operating system that compartmentalises work into isolated virtual machines.
Kicksecure
Hardened Debian derivative with kernel hardening and exploit mitigations.
OpenSnitch
An interactive application firewall for Linux that asks before letting any program make an outbound connection.
USBGuard
A Linux framework that allows or blocks USB devices according to rules you write.
