Home

Awesome

Firejail

screenshot

Whats Firejail?

...and why should I use it?

Requisites

Install

Use

import firejail

# Create a Firejail, all args are optional, all options are Boolean, super easy!.
let myjail = Firejail(no3d=true, noDbus=true, noDvd=true, noRoot=true, noSound=true,
                      noVideo=true, noShell=true, noX=true, noNet=true, noIp=true)

echo myjail.list() # List all Firejails sandboxes running, return a seq[JsonNode] (computer friendly)

echo myjail.tree() # List all Firejails sandboxes running, return a string (human friendly)

echo myjail.shutdown(pid=42) # Shutdown a running Firejail sandbox by PID, return bool, true if Ok

echo myjail.exec("myApp --some-arg") # Run your App isolated inside the Firejail.

# For more info read the Docs...

API

Real world usage

FAQ

Written in C with no dependencies, runs on any Linux, can sandbox any type of processes.

Yes.

https://snyk.io/blog/top-ten-most-popular-docker-images-each-contain-at-least-30-vulnerabilities

Hacking Docker with CURL.

Docker current issues is a lack of strong security, 1 security breach in 1 container can be exploited to access all containers on the server, since containers share resources with each others. This doesnt do virtualization but is more like a locked-down secure chroot jail, which grants a locked-down view of a system. Sometimes even basic tiny libs and drivers have security vulnerabilities, virtualized or not. With this your software can only access what it needs to access, and not a whole system, virtualized or not. This works with simple booleans, as example noDbus=true and DBus is gone, but good luck stripping all D-Bus from the Ubuntu running inside that Docker.

No. firejail cant run on the browser.

Network MTU Jumbo Frames. This is optional. This is just a shortcut to improve UX. https://wiki.archlinux.org/index.php/jumbo_frames

Forces EN English as language and UTF-8 Unicode as encoding on Firejail. This is optional. This is just a shortcut to improve UX.

Random Network MAC Address on Firejail. This is optional. This is just a shortcut to improve UX.

Devices send a signal to look for networks, the signal contains the unique physical hardware (MAC) address for your device, this unique address can be used to track you on a network and "map" a network, you can use a random MAC address to make it harder to track. This is optional. This is just an extra feature so you dont have to do it manually if you need to.

Xephyr and Xpra quits complaining about the need to install extra libs. none quits complaining about the network, seems network dependent. Xvfb is the one that seems more standalone and dont complain while gets the job done. Xvfb is usually installed more frequently than Xephyr and Xpra. Xvfb is usually used for Continuous Integration and Testing. We need one that can run in a Non-Interactive way. Firejail by default is more strict than Docker.

Those seems like invalid paths for Whitelisting, Firejail wont accept these paths. Your own home directory root path also seems invalid to whitelist, but you can whitelist any folder inside your own home directory root path. Firejail by default is more strict than Docker.