netblue30/firejail

Health v2 · maintenance only

Adoption not part of the score

7611 stars · 671 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Firejail is a SUID security sandbox program for Linux that uses kernel namespaces, seccomp-bpf filters, and Linux capabilities to run applications in restricted environments. It ships with security profiles for over 1000 popular desktop applications and requires no daemons or complex configuration.

Use cases

• sandbox firefox or chromium to protect against browser exploits
• run untrusted applications with restricted filesystem access
• isolate an app's network stack with a private TCP/IP stack
• protect ssh keys and gpg private data from desktop apps
• sandbox servers like nginx with restricted capabilities
• run AppImage packages in a secure sandbox
• set up a hardened Tor browser environment
• integrate automatic sandboxing into the desktop with firecfg

When to choose

• you want lightweight, low-overhead sandboxing on any Linux 3.x+ kernel
• you need out-of-the-box profiles for common desktop applications
• you prefer no daemons, sockets, or complicated configuration files
• you want to combine sandboxing with SELinux, AppArmor, or X11 isolation

When to avoid

• you are on a multiuser server where SUID binaries pose a risk
• you need sandboxing for client-server apps like multi-tab terminal emulators
• you require container-grade isolation with full image management
• you are not running Linux

Facets

cli-tool · maturity active

security privacy networking configuration-management security privacy operating-systems developer-tools cli sandbox seccomp-bpf linux-namespaces apparmor selinux suid appimage security-profiles desktop-applications sandboxing command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="netblue30/firejail")