netblue30
l3net.wordpress.com · Personal blog · on HN since 2013
netblue30 is the developer of Firejail, a Linux sandbox, and writes about sandboxing, Debian setups, and lightweight desktops.
What HN saysHN commenters recommend its Firejail posts as a way to sandbox browsers and desktop apps using namespaces and seccomp, instead of heavier container tools.
22HN people shared it
12linked it in comments
28stories submitted
344story points
11 years agolast shared
2013people per year2026
Most-shared posts
- 1Firejail – Simple Linux sandbox with seccomp8 people · 66 points · first shared 2014 · 10 comments on HN
- 2Firejail – A Security Sandbox for Mozilla Firefox, Part 15 people · 6 points · first shared 2014 · discussion on HN
- 3A Memory Comparison of Light Linux Desktops2 people · 79 points · first shared 2013 · 39 comments on HN
- 4Debian Virtualization: LXC Network Isolation2 people · 45 points · first shared 2013 · 4 comments on HN
- 5Lightweight Debian: LXDE Desktop From Scratch2 people · 6 points · first shared 2013 · discussion on HN
- 6Debian/Ubuntu Cross-distro Gaming with Firejail2 people · 4 points · first shared 2014 · 1 comments on HN
- 7A Memory Comparison of Light Linux Desktops1 people · 101 points · first shared 2013 · 80 comments on HN
- 8Freejail: a Linux security sandbox1 people · 5 points · first shared 2016 · discussion on HN
- 9Lightweight Debian: LXDE Desktop from Scratch1 people · 4 points · first shared 2014 · discussion on HN
- 10Debian Virtualization: LXC Desktop Virtualization1 people · 4 points · first shared 2013 · discussion on HN
- 11Fedora Memory Comparison1 people · 3 points · first shared 2013 · discussion on HN
- 12Ubuntu Desktop Memory Comparison1 people · 3 points · first shared 2013 · discussion on HN
- 13Debian Virtualization: LXC Application Containers1 people · 3 points · first shared 2013 · discussion on HN
- 14How to Package and Publish an Open Source Project1 people · 3 points · first shared 2013 · discussion on HN
- 15Fedora 19 LXDE Spin Cleanup1 people · 2 points · first shared 2013 · discussion on HN
What HN people wrote when they linked it
tobbyb · 2015-08-07
The new Firejail app [1] may be worth exploring as it is designed to run locally installed apps like browsers and games in sandboxes, as opposed to more chroot oriented container managers like LXC, Docker or Nspawn. They all use namespaces.
If you want to use a chroot oriented container manager its better to use an unprivileged container so you are not running as root. Currently only LXC has support for unprivileged containers. We have an experimental GUI app container with Chrome that can be used in unprivileged mode. [2]
You can even run your own sandbox with a simple command like this 'unshare -fp --mount-proc' That gives you a bash shell in its own pid space. You can expand this command further to use more namespaces like mount, net, user to get yourself a sandbox.
That is what apps like firejail and container managers are using, but its useful to know what's happening underneath. We are currently working on a guide on how to use unshare that may help. [3]
[1] https://l3net.wordpress.com/projects/firejail/
[2] https://www.flockport.com/apps/lxc-gui/
[3] https://www.flockport.com/how-linux-containers-work/
the8472 · 2016-04-20
we can get better compartmentalization than that with things like user namespaces (firejail[1]) or spawning a temporary user id[2]
[1] https://l3net.wordpress.com/projects/firejail/
[2] https://github.com/teran-mckinney/raru
heinrich5991 · 2015-08-12
You could use firejail[1].
[1]: https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for…
anthk · 2015-08-10
dbbolton · 2015-08-07
It can be with Firejail: https://l3net.wordpress.com/projects/firejail/
chilicuil · 2015-08-07
Updating software shouldn't give a sense of security, instead use sandbox/cipher technologies more generalized, for firefox you could use firejail[0] or sandfox[1].
Or even more general approaches like subuser[2] or QubeOs[3].
Personally I use FF 28.x + Noscript + Adblock plus + Firejail 0.9.28-1 and I feel quite confident I won't get hacked by random attacks.
[0] https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for…
[1] https://igurublog.wordpress.com/downloads/script-sandfox/
[2] http://subuser.org/
[3] https://www.qubes-os.org/
sleepycal · 2015-02-07
Thanks for the feedback and alternatives, I hadn't seen Spoon or LXD yet so I'll check those out. Namespaces are sometimes supported directly by the application itself, for example uWSGI, and anything lacking native support you can use firejail [1]. There is also an article [2] by an OVH employee about using namespaces directly in C.
[1]: https://l3net.wordpress.com/projects/firejail/
[2]: https://blog.jtlebi.fr/2013/12/22/introduction-to-linux-namespaces-par…
nullsocket · 2014-10-09
Firejail anyone?
http://l3net.wordpress.com/projects/firejail/
jude- · 2014-09-23
> Lastly, lightweight containers are the real-deal for small development tasks (not for production!). Just one command: systemd-nspawn, and you're ready to go.
You might be interested in firejail [1]. It makes finer-grained use of Linux namespaces, and doesn't depend on systemd (or much of anything, for that matter).
[1] http://l3net.wordpress.com/projects/firejail/
bertoluci · 2014-08-27
I've been using Firejail for this purpose:
http://l3net.wordpress.com/2014/04/16/how-to-restrict-a-login-shell-us…
persepolist123 · 2014-02-23
This is a nice blog post about isolating your container network stack using LXC:
http://l3net.wordpress.com/2013/08/25/debian-virtualization-lxc-networ…
ics · 2013-07-08
Link for the lazy: https://l3net.wordpress.com/2013/03/17/a-memory-comparison-of-light-li…
Also covers XFCE, awesome, *box, etc.