Firejail
github.com/netblue30/firejailFirejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. Written in C, virtually no dependencies, runs on any modern Linux system, with no daemon running in the background, no complicated configuration, and it's super lightweight and super secure, since all actions are implemented by the kernel. It includes security profiles for over 800 common Linux applications. FireJail is recommended for running any app that may potential pose some kind of risk, such as torrenting through Transmission, browsing the web, opening downloaded attachments.
- Homepage:github.com/netblue30/firejail
- GitHub:github.com/netblue30/firejail
- Web info:web-check.xyz/check/github.com
Firejail Source Code
Author
Description
Linux namespaces and seccomp-bpf sandbox
Homepage
https://firejail.wordpress.comRepository
- LicenseGPL-2.0
- Created08 Aug 15
- Primary languageC
- Size24,741 KB
- Stars7,692
- Forks675
- Watchers7,692
Top Contributors
@kmk3 (1418)
@netblue30 (1092)
@smitsohu (790)
@Fred-Barclay (494)
@SkewedZeppelin (344)
@rusty-snake (339)
@reinerh (332)
@dependabot[bot] (173)
@startx2017 (120)
@SYN-cook (90)
@Vincent43 (79)
@manevich (60)
@avoidr (59)
@topimiettinen (58)
@valoq (48)
@CodeArtisan00 (47)
@chiraag-nataraj (45)
@vismir2 (40)
@pierretom (37)
@kris7t (37)
@crass (35)
@bbhtt (35)
@tredondo (32)
@jose1711 (30)
@flacks (27)
@Kishore96in (25)
@nidamanx (24)
@veloute (24)
@KellerFuchs (21)
@probonopd (15)
@thomasjfox (14)
@a1346054 (14)
@amano-kenji (14)
@gcb (13)
@powerjungle (12)
@pizzadude (12)
@NetSysFire (12)
@aminvakil (11)
@vnepogodin (10)
@antonv6 (10)
@Sadoon-AlBader (10)
@TheDarkTrumpet (9)
@spiiroin (9)
@curiosity-seeker (9)
@hawkeye116477 (9)
@corecontingency (8)
@Dpeta (8)
@onny (8)
@adrianlshaw (8)
@mahdi1234 (8)
@slowpeek (7)
@ChrysoliteAzalea (7)
@haplo (7)
@sarneaud (7)
@curiosityseeker (7)
@baryluk (7)
@ValdikSS (7)
@xplanthris (7)
@konstantin1722 (7)
@jgriffiths (7)
@hlein (7)
@laomaiweng (6)
@lucasmz-dev (6)
@aerusso (6)
@davidebeatrici (6)
@thewisenerd (6)
@jelford (6)
@crocket (6)
@jmetrius (6)
@announ (6)
@nullenvk (5)
@KOLANICH (5)
@0x7969 (5)
@sgtpep (5)
@Edu4rdSHL (5)
@pigmonkey (5)
@StellariusOrion592 (5)
@greigdp (5)
@laniakea64 (5)
@caydey (4)
@m00nwtchr (4)
@rahiel (4)
@rc2dev (4)
@njfox (4)
@Liorst4 (4)
@diepfote (4)
@Duncaen (4)
@Tus1688 (4)
@sofoxe1 (4)
@northboot (4)
@layderv (4)
@nuxwin (4)
@marek22k (4)
@pyther (4)
@mhaas (4)
@matu3ba (4)
@reedriley (4)
@onovy (4)
@botherder (4)
@Tomin1 (3)
Recent Commits
--x11 restructuring - part 1
cleaning up some dead code
minor cleanup
RELNOTES
fixed make clean (test directory)
merges
Merge pull request #7246 from sanka-eu/fix_netns_arg_pointer profile.c: fix use of dangling pointer for netns argument
use private-cache in all chromium-based browsers; added a --include command line option to profstats
fix firejail --version
remove ssh restricted shell feature
added private-cache to firefox-common.profile
remove some dead code
more --private-lib removal
remove --private-lib
removed firecfg --guid; the pertinent information was moved in man firejail
added a section about the global configuration file in man firejail
build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 (#7254) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.0 to 2.21.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/05e31511f85b41b11d1cf0ef85d0992719546e2c...e14015d583714f6e62063499dc959a02595150a1) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.21.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps): bump the codeql-actions group with 2 updates (#7253) Bumps the codeql-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.9 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
sanka-eu(22 Sept 26)
profile.c: fix use of dangling pointer for netns argument The "netns" profile command stored a pointer into the line buffer used while parsing the profile (arg_netns = ptr + 6), unlike similar commands such as netfilter, which copy their argument. arg_netns is only used later, when the sandbox is created, so if that buffer is freed or reused in the meantime, firejail tries to join a bogus namespace, e.g.: Error: cannot open netns '${RUNUSER}/dconf' (/var/run/netns/${RUNUSER}/dconf: No such file or directory) Duplicate the argument with strdup().
build: fix codespell warnings Warnings: $ make codespell Running codespell... ./README:754: gampad ==> gamepad ./README:1390: Hense ==> Hence make: *** [Makefile:377: codespell] Error 65 $ codespell --version 2.4.4.dev0+g57b21406f.d20260715 Related commits: * 33d31bf7d ("README update", 2021-10-21) * efd290aec ("RELNOTES: add modif, bugfix, build and profile items", 2026-09-20)
RELNOTES: add modif, bugfix, build and profile items Relates to #6450 #7134 #7225 #7227 #7233 #7235 #7237 #7238.
RELNOTES: add bugfix, build, ci and profile items Relates to #7081 #7210 #7212 #7209 #7216 #7222 #7223 #7224.
test: check for errors when running some app test files To catch typos in array items, each of which is used as a part of the .exp filename that is executed. Example: $ cd test/apps $ ./foo.exp bash: ./foo.exp: No such file or directory $ echo "$?" 127 Related commits: * 0b70db165 ("test/apps/apps.sh: fix typo of "loupe"", 2026-09-11) * 983a8b350 ("test/apps/apps.sh: fix typo of "pavucontrol"", 2026-09-11)
test: include .exp filename in some log messages
test/private-lib/private-lib.sh: add missing quotes for "$app" Fixes a shellcheck warning: $ shellcheck test/private-lib/private-lib.sh In test/private-lib/private-lib.sh line 7: [...] In test/private-lib/private-lib.sh line 36: ./$app.exp ^--^ SC2086 (info): Double quote to prevent globbing and word splitting. Did you mean: ./"$app".exp For more information: https://www.shellcheck.net/wiki/SC2086 -- Double quote to prevent globbing ... Added on commit 6b92f685e ("private-lib", 2017-10-10).
test/apps/apps.sh: remove some redundant comments The same words already appear in the nearby `echo` commands.
test/apps/apps.sh: deduplicate app test lines See also commit 027cb4f54 ("test/apps/apps.sh: add missing quotes for "$app"", 2026-09-11).
test/apps/apps.sh: add missing quotes for "$app" Fixes a shellcheck warning: $ shellcheck test/apps/apps.sh [...] In test/apps/apps.sh line 22: ./$app.exp ^--^ SC2086 (info): Double quote to prevent globbing and word splitting. Did you mean: ./"$app".exp For more information: https://www.shellcheck.net/wiki/SC2086 -- Double quote to prevent globbing ... Added on commit 5d78ff54a ("Removing time-reading syscalls from @clock group. It stops several networked programs such as firefox, or any other program that tries to access the time. For example: firejail sleep 10", 2026-01-25).
test/apps/apps.sh: fix typo of "quick" This amends commit 5d78ff54a ("Removing time-reading syscalls from @clock group. It stops several networked programs such as firefox, or any other program that tries to access the time. For example: firejail sleep 10", 2026-01-25).
test/apps/apps.sh: move lists of apps into applist.sh The lists of apps are getting quite long (currently 76 items in total), so move them to a dedicated file.
Firejail Security
Firejail Reviews
More Linux Defenses
Clears cache and deletes temporary files very effectively. This frees up disk space, improves performance, but most importantly helps to protect privacy.
Locally checks for signs of a rootkit.
ClamTk is basically a graphical front-end for ClamAV, making it an easy to use, light-weight, on-demand virus scanner for Linux systems.
Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-overhead, under active maintenance and backed by a strong community. Installable through most package managers, or compile from source.
Open source intrusion prevention system capable of real-time traffic analysis and packet logging.
Open-source, host-local Linux security orchestrator combining nftables enforcement, system telemetry, threat-intelligence feeds, out-of-band WAAP log analysis and a terminal dashboard. It requires Linux administration and is not an inline proxy.
About the Data: Firejail
Edit Firejail Data
You can edit Firejail's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Firejail's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/firejailThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Firejail
Help your friends compare Linux Defenses, and pick privacy-respecting software and services.
Share Firejail and Awesome Privacy with your network!