Firejail
github.com/netblue30/firejailFirejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. Written in C, virtually no dependencies, runs on any modern Linux system, with no daemon running in the background, no complicated configuration, and it's super lightweight and super secure, since all actions are implemented by the kernel. It includes security profiles for over 800 common Linux applications. FireJail is recommended for running any app that may potential pose some kind of risk, such as torrenting through Transmission, browsing the web, opening downloaded attachments.
- Homepage: github.com/netblue30/firejail
- GitHub: github.com/netblue30/firejail
- Web info: web-check.xyz/check/github.com
Firejail Source Code
Author
Description
Linux namespaces and seccomp-bpf sandbox
Homepage
https://firejail.wordpress.comLicense
GPL-2.0
Created
08 Aug 15
Last Updated
12 Jul 26
Latest version
Primary Language
C
Size
23,865 KB
Stars
7,527
Forks
669
Watchers
7,527
Language Usage
Star History
Top Contributors
-
@kmk3 (1309)
-
@netblue30 (1060)
-
@smitsohu (790)
-
@Fred-Barclay (494)
-
@SkewedZeppelin (344)
-
@rusty-snake (339)
-
@reinerh (332)
-
@dependabot[bot] (166)
-
@startx2017 (120)
-
@SYN-cook (90)
-
@Vincent43 (79)
-
@manevich (60)
-
@avoidr (59)
-
@topimiettinen (58)
-
@valoq (48)
-
@CodeArtisan00 (47)
-
@chiraag-nataraj (45)
-
@vismir2 (40)
-
@kris7t (37)
-
@crass (35)
-
@bbhtt (35)
-
@pierretom (35)
-
@tredondo (32)
-
@jose1711 (30)
-
@flacks (27)
-
@Kishore96in (25)
-
@nidamanx (24)
-
@veloute (24)
-
@KellerFuchs (21)
-
@probonopd (15)
-
@thomasjfox (14)
-
@a1346054 (14)
-
@amano-kenji (14)
-
@gcb (13)
-
@NetSysFire (12)
-
@pizzadude (12)
-
@powerjungle (12)
-
@Sadoon-AlBader (10)
-
@antonv6 (10)
-
@vnepogodin (10)
-
@aminvakil (10)
-
@TheDarkTrumpet (9)
-
@spiiroin (9)
-
@curiosity-seeker (9)
-
@hawkeye116477 (9)
-
@adrianlshaw (8)
-
@onny (8)
-
@mahdi1234 (8)
-
@corecontingency (8)
-
@Dpeta (8)
-
@ChrysoliteAzalea (7)
-
@haplo (7)
-
@slowpeek (7)
-
@sarneaud (7)
-
@hlein (7)
-
@jgriffiths (7)
-
@konstantin1722 (7)
-
@xplanthris (7)
-
@ValdikSS (7)
-
@baryluk (7)
-
@curiosityseeker (7)
-
@announ (6)
-
@crocket (6)
-
@jmetrius (6)
-
@thewisenerd (6)
-
@laomaiweng (6)
-
@aerusso (6)
-
@jelford (6)
-
@davidebeatrici (6)
-
@lucasmz-dev (6)
-
@nullenvk (5)
-
@KOLANICH (5)
-
@laniakea64 (5)
-
@greigdp (5)
-
@pigmonkey (5)
-
@Edu4rdSHL (5)
-
@sgtpep (5)
-
@0x7969 (5)
-
@Liorst4 (4)
-
@diepfote (4)
-
@Duncaen (4)
-
@njfox (4)
-
@rc2dev (4)
-
@m00nwtchr (4)
-
@rahiel (4)
-
@caydey (4)
-
@Tus1688 (4)
-
@sofoxe1 (4)
-
@northboot (4)
-
@layderv (4)
-
@StellariusOrion592 (4)
-
@reedriley (4)
-
@onovy (4)
-
@botherder (4)
-
@mhaas (4)
-
@pyther (4)
-
@marek22k (4)
-
@nuxwin (4)
-
@matu3ba (4)
-
@Tomin1 (3)
Recent Commits
-
deprecated --private-home
-
deprecated ./configure --enable-busybox-workaround
-
deprecating --tracelog/tracelog/blacklist-nolog
-
depracating --bandwidth commands
-
more testing
-
build(deps): bump the codeql-actions group with 2 updates Bumps the codeql-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.36.0 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `github/codeql-action/analyze` from 4.36.0 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]>
-
ci: dependabot: fix non-unique "package-ecosystem" keys From [1]: > Your .github/dependabot.yml contained invalid details > > Dependabot encountered the following error when parsing your > `.github/dependabot.yml`: > > Update configs must have a unique combination of 'package-ecosystem', 'directory', and 'target-branch'. Ecosystem 'github-actions' has overlapping directories. > > Please update the config file to conform with Dependabot's specification. This amends commit 6b62c44d9 ("ci: dependabot: split and group codeql actions to fix checks (#7192)", 2026-07-03). [1] https://github.com/netblue30/firejail/runs/84961046604
-
ci: dependabot: split and group codeql actions to fix checks (#7192) Dependabot used to update all CodeQL actions at once ("bump github/codeql-action") in the same PR. For example: * PR #7178: build(deps): bump github/codeql-action from 4.35.2 to 4.36.0 Now it started updating each CodeQL action in a separate PR: * PR #7189: build(deps): bump github/codeql-action/init from 4.36.0 to 4.36.2 * PR #7191: build(deps): bump github/codeql-action/analyze from 4.36.0 to 4.36.2 This breaks CI due to version mismatches, as the CI job runs with one action using the new version and the other one using the old version. Use grouping to ensure that all CodeQL actions are always updated together in the same PR. From #7189[1]: ##[group]Run github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e [...] ##[endgroup] ##[group]Validating workflow ##[warning]1 issue was detected with this workflow: Not all workflow steps that use `github/codeql-action` actions use the same version. Please ensure that all such steps use the same version to avoid compatibility issues. ##[endgroup] [...] ##[group]Run github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa [...] ##[endgroup] ##[error]Loaded a configuration file for version '4.36.2', but running version '4.36.0' Post job cleanup. ##[error]analyze post-action step failed: Loaded a configuration file for version '4.36.2', but running version '4.36.0' Post job cleanup. From #7191[2]: ##[group]Run github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa [...] ##[endgroup] ##[group]Validating workflow ##[warning]1 issue was detected with this workflow: Not all workflow steps that use `github/codeql-action` actions use the same version. Please ensure that all such steps use the same version to avoid compatibility issues. ##[endgroup] [...] ##[group]Run github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e [...] ##[endgroup] ##[error]Loaded a configuration file for version '4.36.0', but running version '4.36.2' Post job cleanup. ##[error]analyze post-action step failed: Loaded a configuration file for version '4.36.0', but running version '4.36.2' Post job cleanup. [1] https://github.com/netblue30/firejail/actions/runs/28497938236/job/84468173598?pr=7189 [2] https://github.com/netblue30/firejail/actions/runs/28497950609/job/84468212940?pr=7191
-
build(deps): bump actions/checkout from 6.0.2 to 7.0.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
-
profiles: fix addition of allow-bwrap command Changes: * Remove it from noprofile.profile * Move it from the "increase access" to the "reduce access" section in profile.template This fixes the following issues: 1. The `allow-bwrap` option is likely to cause significant breakage (see #6906) and is only intended to be used locally, not in upstream profiles. 2. noprofile.profile is supposed to lift as many restrictions as possible, while `allow-bwrap` makes the sandbox more restrictive by using the real bwrap executable, which results in extra rules being applied. Note that noprofile.profile is used to check whether an issue is due to profiles or firejail itself, so if noprofile.profile itself is broken, that impacts the ability to properly debug profiles and handle bug reports. Added on commit 3725c08b2 ("add `allow-bwrap` in profile.template", 2026-06-17). Relates to #6906 #7009. Kind of relates to #7172.
-
test/apps/pitivi.exp: fix unchanged template parts This amends commit 805e5408a ("testing", 2026-06-30).
-
test/apps: fix capitalized program names in messages This amends commit 805e5408a ("testing", 2026-06-30).
-
testing
-
profile fixes
-
test/apps: fix wrong program names in messages This amends commit 1c54aadb6 ("testing", 2026-06-28).
-
profiles: disable-common: fix dpkg comment This amends commit 6c0ec7cce ("remove dpkg blacklist from disable-common.inc", 2026-06-24). Relates to #5987.
-
testing
-
profile fixes (Arch)
-
profiles: profile.template: fix leading comments This amends commit 925bba49a ("Merge branch 'master' into profile-template-improve-rules", 2026-06-24). Relates to #7172.
-
remove dpkg blacklist from disable-common.inc
-
Merge pull request #7172 from kmk3/profile-template-improve-rules profiles: templates: improve formatting & clarify rules
-
Merge branch 'master' into profile-template-improve-rules
-
Merge pull request #7186 from netblue30/fix-metachars modif: add more metachars in `reject_meta_chars()`
-
remove the `--color` option in gen-syscalls.sh It was used for tests in the terminal and no longer required, because Bash disables alias expansion in non-interactive shells.
-
common.c: add more metachars in `reject_meta_chars()` Add: * `#$|` Ignore: * `'()~` Note: `,` does not appear to be a metacharacter, but it (and `%`) are checked in test/fcopy/cmdline.exp. I'm not sure if they matter for fcopy, so they are left as is. Misc: `$` was suggested by @rusty-snake[1]. This is a follow-up to #7183. Relates to #3001 #3156 #4614. [1] https://github.com/netblue30/firejail/pull/7183#issuecomment-4709569497
-
common.c: deduplicate metachar strings in `reject_meta_chars()`
-
add `allow-bwrap` in profile.template
-
common.c: sort metachar strings in `reject_meta_chars()`
-
Devon Kirk (16 Jun 26)
bugfix: add missing backtick in `reject_meta_chars()` (#7183)
-
profiles: lutris: fix proton compatibility (#7181) umu: https://github.com/Open-Wine-Components/umu-launcher seccomp based on this PR: * #5017
Firejail Security
Firejail Reviews
More Linux Defenses
-
Clears cache and deletes temporary files very effectively. This frees up disk space, improves performance, but most importantly helps to protect privacy.
-
Locally checks for signs of a rootkit.
-
ClamTk is basically a graphical front-end for ClamAV, making it an easy to use, light-weight, on-demand virus scanner for Linux systems.
-
Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-overhead, under active maintenance and backed by a strong community. Installable through most package managers, or compile from source.
-
Open source intrusion prevention system capable of real-time traffic analysis and packet logging.
About the Data: Firejail
API
You can access Firejail's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/firejailThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Firejail
Help your friends compare Linux Defenses, and pick
privacy-respecting software and services.
Share Firejail and Awesome Privacy with your network!