Firejail
github.com/netblue30/firejailFirejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. Written in C, virtually no dependencies, runs on any modern Linux system, with no daemon running in the background, no complicated configuration, and it's super lightweight and super secure, since all actions are implemented by the kernel. It includes security profiles for over 800 common Linux applications. FireJail is recommended for running any app that may potential pose some kind of risk, such as torrenting through Transmission, browsing the web, opening downloaded attachments.
- Homepage:github.com/netblue30/firejail
- GitHub:github.com/netblue30/firejail
- Web info:web-check.xyz/check/github.com
Firejail Source Code
Author
Description
Linux namespaces and seccomp-bpf sandbox
Homepage
https://firejail.wordpress.comRepository
- LicenseGPL-2.0
- Created08 Aug 15
- Primary languageC
- Size24,322 KB
- Stars7,580
- Forks669
- Watchers7,580
Top Contributors
@kmk3 (1384)
@netblue30 (1071)
@smitsohu (790)
@Fred-Barclay (494)
@SkewedZeppelin (344)
@rusty-snake (339)
@reinerh (332)
@dependabot[bot] (169)
@startx2017 (120)
@SYN-cook (90)
@Vincent43 (79)
@manevich (60)
@avoidr (59)
@topimiettinen (58)
@valoq (48)
@CodeArtisan00 (47)
@chiraag-nataraj (45)
@vismir2 (40)
@kris7t (37)
@crass (35)
@pierretom (35)
@bbhtt (35)
@tredondo (32)
@jose1711 (30)
@flacks (27)
@Kishore96in (25)
@nidamanx (24)
@veloute (24)
@KellerFuchs (21)
@probonopd (15)
@thomasjfox (14)
@a1346054 (14)
@amano-kenji (14)
@gcb (13)
@powerjungle (12)
@pizzadude (12)
@NetSysFire (12)
@aminvakil (11)
@vnepogodin (10)
@antonv6 (10)
@Sadoon-AlBader (10)
@TheDarkTrumpet (9)
@spiiroin (9)
@curiosity-seeker (9)
@hawkeye116477 (9)
@corecontingency (8)
@Dpeta (8)
@onny (8)
@adrianlshaw (8)
@mahdi1234 (8)
@slowpeek (7)
@ChrysoliteAzalea (7)
@haplo (7)
@sarneaud (7)
@curiosityseeker (7)
@baryluk (7)
@ValdikSS (7)
@xplanthris (7)
@konstantin1722 (7)
@jgriffiths (7)
@hlein (7)
@laomaiweng (6)
@lucasmz-dev (6)
@aerusso (6)
@davidebeatrici (6)
@thewisenerd (6)
@jelford (6)
@crocket (6)
@jmetrius (6)
@announ (6)
@nullenvk (5)
@KOLANICH (5)
@0x7969 (5)
@sgtpep (5)
@Edu4rdSHL (5)
@pigmonkey (5)
@StellariusOrion592 (5)
@greigdp (5)
@laniakea64 (5)
@caydey (4)
@m00nwtchr (4)
@rahiel (4)
@rc2dev (4)
@njfox (4)
@Liorst4 (4)
@diepfote (4)
@Duncaen (4)
@Tus1688 (4)
@sofoxe1 (4)
@northboot (4)
@layderv (4)
@matu3ba (4)
@marek22k (4)
@nuxwin (4)
@pyther (4)
@mhaas (4)
@reedriley (4)
@onovy (4)
@botherder (4)
@Tomin1 (3)
Recent Commits
Merge pull request #7223 from kmk3/build-format-test-targets build: test: format/improve targets
build: test: improve `TESTS` macro in test/Makefile Changes: * Use immediate expansion * Sort paths
build: test: format/simplify lab-setup comment
build: test: line-wrap lab-setup commands
build: test: mark `TEST_TARGETS` as phony
build: test: deduplicate dependencies They are equivalent to `$(TEST_TARGETS)`.
build: test: sort `TESTS` macro
build: test: line-wrap `TESTS` macro
Merge pull request #7222 from kmk3/build-fix-test-clean build: test: fix cleaning of some temporary files
build: test: sort clean commands This amends commit f9cc7b24e ("build: move cleaning of test files to test/Makefile", 2026-01-17).
build: test: fix cleaning of some temporary files Remove the extraneous "test/" prefix on some paths. This amends commit f9cc7b24e ("build: move cleaning of test files to test/Makefile", 2026-01-17).
build(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 (#7221) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.19.4 to 2.20.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...bf7454d06d71f1098171f2acdf0cd4708d7b5920) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.20.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#7220) Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps): bump the codeql-actions group across 1 directory with 2 updates (#7218) Bumps the codeql-actions group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.36.3 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: codeql-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
ci: dependabot: move codeql grouping comment This amends commit 6b62c44d9 ("ci: dependabot: split and group codeql actions to fix checks (#7192)", 2026-07-03).
ci: dependabot: use one PR per action for other actions Currently one PR is being opened for all actions in `codeql-actions` (which is intended, such as PR #7218) and only one other PR is being opened for all other actions (which is not intended, such as PR #7219). Remove the `other-actions` group so that each action outside of `codeql-actions` gets its own PR. This amends commit 6b62c44d9 ("ci: dependabot: split and group codeql actions to fix checks (#7192)", 2026-07-03).
profiles: x11: format comments Related commits: * 4515f44e5 ("merge #1100 from zackw: added support for sandboxing Xpra, Xvfb and Xephyr in independent sandboxes when started with firejail --x11", 2017-05-06) * c62e7c779 ("automatic X server sandboxing for --x11=xpra and --x11=xephyr", 2017-05-12) * 17a89ca17 ("Whitespace fix", 2019-05-08)
profiles: Xephyr: add missing profile description This amends commit 4515f44e5 ("merge #1100 from zackw: added support for sandboxing Xpra, Xvfb and Xephyr in independent sandboxes when started with firejail --x11", 2017-05-06).
profiles: Xephyr: sort header comment This amends commit a88f59362 ("Prevent quiet option output leakage (#2913)", 2019-08-14).
build: remove some remnants of xpra Note: There are still a few xpra-related profile entries and xpra.profile (I'm not sure if they still work without explicit xpra support) and `pid_proc_cmdline_x11_xpra_xephyr()`. Related commits: * 976ab54c2 ("remove x11 xpra support - part 1", 2026-07-18) * 264d2bec4 ("remove xpra suppport - part 2", 2026-07-18) * bc0e362d3 ("firejail.config: remove xpra options", 2026-07-28) Relates to #7207.
docs: man: fix typo in --x11 section This amends commit 264d2bec4 ("remove xpra suppport - part 2", 2026-07-18). Relates to #7207.
bugfix: disable /run/systemd/resolve with net=none (#7216) From @michelesr[1]: > I've noticed that some programs (like Wine for example) tend to use > `/var/run/systemd/resolve/io.systemd.Resolve` (a varlink socket AFAIK) > to talk to systemd-resolved and resolve domain names and this works when > `net none` is used. Just blacklist the directory for now as a quick fix. Closes #7209. [1] https://github.com/netblue30/firejail/issues/7209#issue-4924009444 Reported-by: @michelesr
profiles: llm-agent-common: disable private-cache (#7212) This is a follow-up on my previous multiple PRs for adding profiles of coding agents. Working with them in the past couple of months, I have allowed some `.cache` access in my `.local` file like this: whitelist ${HOME}/.cache/go-build whitelist ${HOME}/.cache/huggingface I think it's better for coding agents to access `.cache` by default, therefore this PR. Also note to myself in future, keep in mind that `disable-programs.inc` already disables accessing many sensitive `.cache` directories like browsers' caches, so with removing `private-cache`, firejail still protects browsers' caches. Relates to #7158.
ci: build: replace ubuntu-22.04 with ubuntu-latest (#7210) The main build job already installs no dependencies and uses the default system compiler, so use the default runner image as well to avoid having to update it. This build should keep working fine regardless of the software versions used since the codebase is basically C89/C99 and `--enable-fatal-warnings` is not used here. Relevant software changes: * ubuntu-22.04 -> ubuntu-24.04 * gcc 11.4.0 -> 13.2.0 Related commits: * dbf4b9a22 ("ci: drop apt dependencies from main build", 2025-01-18) / PR #6864 * 692322b63 ("ci: update clang-14 to clang-18 (#7203)", 2026-07-19) See also: * https://github.com/actions/runner-images/blob/releases/ubuntu22/20260705/images/ubuntu/Ubuntu2204-Readme.md * https://github.com/actions/runner-images/blob/releases/ubuntu24/20260705/images/ubuntu/Ubuntu2404-Readme.md
firejail.config: remove xpra options They are not supported anymore and warnings are already printed if the options are used. Related commits: * 976ab54c2 ("remove x11 xpra support - part 1", 2026-07-18) * 264d2bec4 ("remove xpra suppport - part 2", 2026-07-18) Relates to #7207.
firejail.config: remove private-home option It is not supported anymore and a warning is already printed if the option is used. Related commits: * e5eefcf5f ("deprecated --private-home", 2026-07-09) * 204dbce6f ("build: remove remnants of --private-home=", 2026-07-13) * 3f78a194d ("private-home: clarify deprecated -> removed", 2026-07-13). Relates to #7200.
firejail.config: remove tracelog option It is not supported anymore and a warning is already printed if the option is used. Related commits: * f350bf67d ("deprecating --tracelog/tracelog/blacklist-nolog", 2026-07-09) * ae943bd87 ("build: remove remnants of --tracelog/tracelog command", 2026-07-13) * dd8acaa8f ("tracelog/blacklist-nolog: clarify deprecated -> removed", 2026-07-13) Relates to #7198.
private-home: clarify deprecated -> removed 2 Related commits: * e5eefcf5f ("deprecated --private-home", 2026-07-09) * 3f78a194d ("private-home: clarify deprecated -> removed", 2026-07-13). Relates to #7200.
tracelog/blacklist-nolog: clarify deprecated -> removed 2 Related commits: * f350bf67d ("deprecating --tracelog/tracelog/blacklist-nolog", 2026-07-09) * dd8acaa8f ("tracelog/blacklist-nolog: clarify deprecated -> removed", 2026-07-13) Relates to #7198.
profile.c: turn `x11 xpra` warning into error Similar reason as for commit 213a13995 ("profile.c: turn private-home warning into error", 2026-07-13). This amends commit 976ab54c2 ("remove x11 xpra support - part 1", 2026-07-18). Relates to #7207.
Firejail Security
Firejail Reviews
More Linux Defenses
Clears cache and deletes temporary files very effectively. This frees up disk space, improves performance, but most importantly helps to protect privacy.
Locally checks for signs of a rootkit.
ClamTk is basically a graphical front-end for ClamAV, making it an easy to use, light-weight, on-demand virus scanner for Linux systems.
Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-overhead, under active maintenance and backed by a strong community. Installable through most package managers, or compile from source.
Open source intrusion prevention system capable of real-time traffic analysis and packet logging.
About the Data: Firejail
Edit Firejail Data
You can edit Firejail's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Firejail's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/firejailThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Firejail
Help your friends compare Linux Defenses, and pick privacy-respecting software and services.
Share Firejail and Awesome Privacy with your network!