LinuxAlternative
EN
English Français Español Deutsch Português

Linux · System Tools

Firejail

Firejail is a security tool that isolates applications using Linux namespaces and seccomp to reduce the risk of system compromise.

Open sourceFree
Be the first to rate
License
GPL-2.0
Latest version
0.9.80
Install

What is Firejail?

Firejail uses Linux namespaces and seccomp-bpf to sandbox applications, limiting their access to the filesystem, network, and system calls. It's been actively developed since 2014 and is mature, stable, and widely available across distributions including Arch, Debian, Fedora, openSUSE, and Ubuntu.

It's ideal for users who want to run untrusted or third-party applications with reduced risk. This includes developers testing software, privacy-conscious users, or system administrators hardening desktop environments. It's not designed for casual users unfamiliar with the command line.

Compared to Windows Sandbox, Firejail is more granular and scriptable but less user-friendly. It doesn't require Hyper-V or high RAM, making it lighter, but lacks the point-and-click simplicity of Microsoft's tool. You manage profiles manually or via command-line flags.

Best for: Users who want lightweight, configurable sandboxing for desktop applications without virtualization overhead.

Key features of Firejail

  • Application sandboxing via Linux namespaces and seccomp
  • Predefined security profiles for common programs
  • Network and filesystem isolation
  • Private home and temporary filesystems
  • Seccomp system call filtering
  • Support for GUI applications
  • Profile customization and user-defined rules
  • Chroot and PID namespace isolation

Pros

  • Lightweight and fast — no hypervisor needed
  • Fine-grained control over sandbox policies
  • Available in major distro repositories
  • Can sandbox GUI apps like browsers and PDF readers
  • Actively maintained with strong community support

Cons

  • Steeper learning curve; requires understanding of profiles and permissions
  • Manual configuration needed for non-default apps
  • Not a full virtual machine — isolation is strong but not absolute

Windows programs Firejail replaces

Windows Sandbox

How to install Firejail on Linux

Ubuntu / Mintsudo apt install firejail
Debiansudo apt install firejail
Fedorasudo dnf install firejail
Arch / Manjarosudo pacman -S firejail
openSUSEsudo zypper install firejail

Tips for Windows users

Coming from Windows Sandbox, expect less automation and no GUI sandbox launcher. Instead, you run 'firejail appname' in the terminal. There are no disk images or VM states — each session is stateless unless you configure persistence. Use firejail --list to see running sandboxes and customize profiles in ~/.config/firejail/.

Firejail: frequently asked questions

Is Firejail as secure as a virtual machine?

No, it's not a full VM. It uses OS-level isolation, which is strong but can't protect against kernel exploits like a hypervisor can.

How do I sandbox a new application?

Run 'firejail application-name'. If no profile exists, it uses defaults. You can create custom profiles in ~/.config/firejail/.

Does Firejail work with Docker or Flatpak?

Firejail can run alongside them, but don't nest Firejail inside Docker containers. Flatpak apps already use sandboxing, so Firejail adds little.

Can I persist files between Firejail sessions?

Yes, by default your home is accessible. Use --private or --private=PATH to limit access and control persistence explicitly.

Updated