Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About Firejail
Firejail runs ordinary Linux programs inside a restricted environment built from Linux namespaces and seccomp-bpf filters. Starting a browser, media player or other desktop application through it limits what that program can see and do on the rest of the system.
It is a command-line tool, and the repository includes per-application configuration under its etc directory. It suits Linux desktop users who want to confine untrusted or network-facing programs without setting up virtual machines or containers.
Strengths
- Sandboxes existing applications without modifying them
- Uses kernel namespaces and seccomp-bpf filtering
- Lightweight compared with running a virtual machine
- Long-running project with a large commit history
Limitations
- Linux only
- Runs as a SUID program, which some users consider a risk in itself
- Profiles may need tuning when an application breaks inside the sandbox
Details
- Pricing
- FreeFree and open source.
- License
- GPL-2.0
- Developer
- netblue30
- Platforms
- Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Linux desktop users who want to confine browsers and other untrusted programs
- Categories
- Security tools, Privacy tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to Firejail
Compare allSoftware that can replace Firejail for an important use case, and what changes if you switch.
Bubblewrap
A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.
Bubblewrap sandboxes Linux programs without root or SUID under LGPL-2.0-or-later, but it is low-level with no preset profiles, so every sandbox must be configured by hand.
AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles.
AppArmor is a kernel security module that confines programs through per-application profiles, and writing and tuning those profiles takes time and testing.
SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.
SELinux provides kernel-enforced mandatory access control shipped by Linux distributions, with a steeper learning curve for writing and debugging policy.
gVisor
An application kernel that sandboxes containers to isolate them from the host Linux kernel.
gVisor is an Apache-2.0 application kernel that isolates containers from the host Linux kernel through the runsc runtime, suited to containers rather than confining desktop applications.
Firejail as an alternative
Listings that name Firejail as an alternative.
Sandboxie-Plus
Runs a Windows program inside an isolated box, so whatever it writes to disk or the registry disappears afterwards.
Firejail moves you to Linux, confining existing applications with namespaces and seccomp-bpf, and it runs as a SUID program that some users consider a risk.
Similar software
Related functionality, not necessarily a direct replacement.
Flatseal
A graphical utility for reviewing and changing the permissions of installed Flatpak applications.
Qubes OS
Operating system that compartmentalises work into isolated virtual machines.
Kicksecure
Hardened Debian derivative with kernel hardening and exploit mitigations.
OpenSnitch
An interactive application firewall for Linux that asks before letting any program make an outbound connection.
USBGuard
A Linux framework that allows or blocks USB devices according to rules you write.
