>

Sandbox an Application with Firejail

Isolate any program from the rest of your system using Linux namespaces — hide your home folder, cut the network, or apply the app's built-in security profile.

LinuxsandboxclifirejailsecurityLow risk
Run firejail firefox to launch Firefox under its bundled profile, or firejail --net=none appname to run a program with no network access.

01Command

Command
$ firejail --private firefox && firejail --net=none appname

02What it does

Firejail wraps a program in kernel namespaces, seccomp filters and dropped capabilities so it sees a reduced view of your system. --private gives the app a throwaway empty home directory — ideal for opening files from untrusted sources — while --net=none guarantees no network leak. Hundreds of popular applications ship ready-made profiles, so plain firejail appname usually applies sensible defaults automatically; check what a sandbox gets with firejail --tree while it runs.

03Risk

RiskLow risk
Requirementsfirejail (sudo apt install firejail / sudo dnf install firejail)
!Warning: Firejail uses a setuid binary, which is itself attack surface; keep it updated and remember sandboxes reduce risk, they don't make untrusted software safe to run.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • firejail(1) — Linux manual page
    Arch Linux · community · 2026-09-17
    Evidence: firejail sandboxes applications with namespaces and seccomp-bpf; --private mounts a temporary home, --net=none removes all network access, and profile files (firejail appname) apply per-app rules.
  • Firejail — README
    Firejail project (GitHub) · vendor-doc · 2026-09-17
    Evidence: Official readme describing Firejail as an SUID sandbox program using Linux namespaces, seccomp-bpf and capability restrictions.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17