Firejail

What Firejail is

Firejail is a Linux program that places untrusted applications in restricted environments. It uses Linux namespaces and seccomp-bpf to give sandboxed processes separate views of shared resources, including network, process, and mount tables. It can be used with servers, graphical applications, and login sessions, and runs on Linux computers with a 3.x kernel or newer. Its security controls include protocol filtering, noroot user namespaces, Linux capabilities, D-BUS filtering, and optional AppArmor or SELinux support. Mandatory Access Control can prevent more than 1,000 desktop applications from reaching passwords, encryption keys, and private data; more than 1,000 profiles are included by default. Firejail can create an isolated TCP/IP stack with its own routing table, firewall, and interfaces, and its nettrace feature can inspect traffic. It supports AppImage packages. Firetools adds a Qt5 graphical interface for launching and managing sandboxes, while FDNS offers a DNS-over-HTTPS proxy using non-logging providers. The free, self-hosted GPL v2 community project targets home users and Linux beginners rather than enterprise use.