Firejail
github.com/netblue30/firejailFirejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. Written in C, virtually no dependencies, runs on any modern Linux system, with no daemon running in the background, no complicated configuration, and it's super lightweight and super secure, since all actions are implemented by the kernel. It includes security profiles for over 800 common Linux applications. FireJail is recommended for running any app that may potential pose some kind of risk, such as torrenting through Transmission, browsing the web, opening downloaded attachments.
- Homepage:github.com/netblue30/firejail
- GitHub:github.com/netblue30/firejail
- Web info:web-check.xyz/check/github.com
Firejail Source Code
Author
Description
Linux namespaces and seccomp-bpf sandbox
Homepage
https://firejail.wordpress.comRepository
- LicenseGPL-2.0
- Created08 Aug 15
- Primary languageC
- Size24,215 KB
- Stars7,737
- Forks678
- Watchers7,737
Top Contributors
@kmk3 (1460)
@netblue30 (1115)
@smitsohu (790)
@Fred-Barclay (494)
@SkewedZeppelin (344)
@rusty-snake (339)
@reinerh (332)
@dependabot[bot] (175)
@startx2017 (120)
@SYN-cook (90)
@Vincent43 (79)
@manevich (60)
@avoidr (59)
@topimiettinen (58)
@valoq (48)
@CodeArtisan00 (47)
@chiraag-nataraj (45)
@pierretom (41)
@vismir2 (40)
@kris7t (37)
@crass (35)
@bbhtt (35)
@tredondo (32)
@jose1711 (30)
@flacks (27)
@Kishore96in (25)
@nidamanx (24)
@veloute (24)
@KellerFuchs (21)
@probonopd (15)
@amano-kenji (14)
@a1346054 (14)
@thomasjfox (14)
@gcb (13)
@NetSysFire (12)
@pizzadude (12)
@powerjungle (12)
@aminvakil (11)
@Sadoon-AlBader (10)
@antonv6 (10)
@vnepogodin (10)
@TheDarkTrumpet (9)
@spiiroin (9)
@curiosity-seeker (9)
@hawkeye116477 (9)
@adrianlshaw (8)
@onny (8)
@mahdi1234 (8)
@corecontingency (8)
@Dpeta (8)
@ChrysoliteAzalea (7)
@haplo (7)
@slowpeek (7)
@sarneaud (7)
@davidebeatrici (7)
@hlein (7)
@jgriffiths (7)
@konstantin1722 (7)
@xplanthris (7)
@ValdikSS (7)
@baryluk (7)
@curiosityseeker (7)
@announ (6)
@crocket (6)
@jmetrius (6)
@thewisenerd (6)
@aerusso (6)
@laomaiweng (6)
@jelford (6)
@lucasmz-dev (6)
@cobratbq (5)
@nullenvk (5)
@KOLANICH (5)
@sgtpep (5)
@Edu4rdSHL (5)
@pigmonkey (5)
@0x7969 (5)
@StellariusOrion592 (5)
@greigdp (5)
@laniakea64 (5)
@rc2dev (4)
@njfox (4)
@Liorst4 (4)
@diepfote (4)
@Duncaen (4)
@m00nwtchr (4)
@caydey (4)
@rahiel (4)
@Tus1688 (4)
@sofoxe1 (4)
@matu3ba (4)
@nuxwin (4)
@marek22k (4)
@pyther (4)
@mhaas (4)
@botherder (4)
@onovy (4)
@reedriley (4)
@Antiz96 (4)
@layderv (4)
Recent Commits
bugfix: restore `x11 (xorg|xvfb)` profile commands (#7305) Changes: * Restore legacy x11 profile commands * Error on legacy x11 options when `HAVE_X11 && !HAVE_X11_LEGACY` When `./configure --enable-x11-legacy` is used, the `--x11=(xorg|xvfb)` CLI options are still available, so restore the `x11 (xorg|xvfb)` profile commands to match them. Print errors to clarify when the options are unavailable and why. Related commits: * 830f23991 ("--x11 restructuring - part 2", 2026-10-08) Relates to #7263.
docs: fix incorrect descriptions of `--x11` command See `x11_start()` in src/firejail/x11.c. Related commits: * 976ab54c2 ("remove x11 xpra support - part 1", 2026-07-18) Relates to #7207 #7263 #7297.
docs: man: fix broken .br in x11 section This amends commit 08e51629c ("--x11 restructuring - part 1", 2026-10-07). Relates to #7297.
docs: fix usage of `--x11=(xorg|xvfb)` being shown by default Related commits: * 08e51629c ("--x11 restructuring - part 1", 2026-10-07) * 830f23991 ("--x11 restructuring - part 2", 2026-10-08) Relates to #7263.
build: configure: sort x11 variables This amends commit 830f23991 ("--x11 restructuring - part 2", 2026-10-08). Relates to #7263.
profiles: remove more remnants of xpra (#7302) Note: Not sure if the xpra server also uses ~/.xpra, but allow it just in case. Related commits: * 6c4b75546 ("build: remove some remnants of xpra", 2026-08-01) * abfad3870 ("profiles: x11: format comments", 2026-08-01) Relates to #7207.
profiles: disable-common: sort X11 section Relates to #7207.
dogknowsnx(07 Nov 26)
profiles: mpv: fix dbus mpris (#7298) `firejail version 0.9.82` (local build on Void Linux - no systemd). Fixes errors like those shown below (and unbreaks `mpv` for me): (process:28): GLib-GIO-WARNING **: 11:57:29.946: Error releasing name org.mpris.MediaPlayer2.mpv.instance-XnUNEAvI: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown Relates to #7237.
modif: use semicolons to split fields in seccomp list message (#7294) Changes: * Separate the "Seccomp list in", "check list", "prelist" and "postlist" fields with semicolons, so they are no longer confused with the commas between syscalls. * Drop the trailing separator at the end of the line. * Update the example in the Firejail man page to match the actual output. Example: firejail --noprofile --seccomp=keyctl,getcpu true Before: Seccomp list in: keyctl,getcpu, check list: @default-keep, prelist: keyctl,getcpu, After: Seccomp list in: keyctl,getcpu; check list: @default-keep; prelist: keyctl,getcpu
RELNOTES: split 0.9.82 and 0.9.82.2 To avoid confusion, split the releases and note what exactly changed in 0.9.82.2, as 0.9.82 had already been released and packaged in some distributions. Also, improve the release fix item and move it into 0.9.82.2. This amends commit 6c605b68d ("release 0.9.82.2 testing", 2026-11-03). Relates to #7104 #7299.
moving back to 0.9.83
release 0.9.82.2 testing
RELNOTES: move, merge and improve x11/ip removal items Relates to #7207 #7263 #7264 #7297.
RELNOTES: move build item into removals Relates to #7202.
RELNOTES: improve wording/formatting of removal items Relates to #7197 #7198 #7199 #7200 #7201 #7207 #7261 #7262.
RELNOTES: reword test/apps item Added on commit 6af6951d4 ("relnotes for 0.9.82", 2026-11-02).
RELNOTES: add WIP release 0.9.83 This amends commit 6af6951d4 ("relnotes for 0.9.82", 2026-11-02). Relates to #7104.
docs: update supported version to 0.9.82 Relates to #7104.
RELNOTES: fix release date for 0.9.82 This amends commit 6af6951d4 ("relnotes for 0.9.82", 2026-11-02).
moving to 0.9.83
release 0.9.82 testing
relnotes for 0.9.82
profiles: tor: format comments Related commits: * 9c833ae92 ("Add 31 profiles", 2017-09-16) / PR #1555
profiles: tor: improve script comment Changes: * Use absolute program path (see #2877) * Change hardcoded profile path into profile name (which also checks in /etc/firejail) Related commits: * 9c833ae92 ("Add 31 profiles", 2017-09-16) / PR #1555
profiles: minetest: replace `/home/<USER>` with `~` Related commits: * deb6c1245 ("hardening some profiles (#3505)", 2020-07-09)
profiles: arch: use `${PROJECTS}` macro This amends commit 5abf0577a ("feature: add `${PROJECTS}` macro (#7157)", 2026-05-09). Related commits: * d0ae07485 ("makepkg profile for Arch platform, #1642", 2017-11-15) * 6c10737f0 ("archaudit-report and cower for Arch platforms, #1642", 2017-11-15)
profiles: gitg: use `${PROJECTS}` macro This amends commit 5abf0577a ("feature: add `${PROJECTS}` macro (#7157)", 2026-05-09).
RELNOTES: add `syscall:log` feature item Relates to #7289.
docs: man: remove two line breaks to merge the syscall numbers into a paragraph
Merge pull request #7290 from netblue30/dependabot/github_actions/codeql-actions-271845e79b build(deps): bump the codeql-actions group with 2 updates
Firejail Security
Firejail Reviews
More Linux Defenses
Clears cache and deletes temporary files very effectively. This frees up disk space, improves performance, but most importantly helps to protect privacy.
Locally checks for signs of a rootkit.
ClamTk is basically a graphical front-end for ClamAV, making it an easy to use, light-weight, on-demand virus scanner for Linux systems.
Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-overhead, under active maintenance and backed by a strong community. Installable through most package managers, or compile from source.
Open source intrusion prevention system capable of real-time traffic analysis and packet logging.
Open-source, host-local Linux security orchestrator combining nftables enforcement, system telemetry, threat-intelligence feeds, out-of-band WAAP log analysis and a terminal dashboard. It requires Linux administration and is not an inline proxy.
About the Data: Firejail
Edit Firejail Data
You can edit Firejail's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Firejail's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/firejailThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Firejail
Help your friends compare Linux Defenses, and pick privacy-respecting software and services.
Share Firejail and Awesome Privacy with your network!