Skip to main content

​
Why This Matters

It’s absolutely better, for many applications, to run in a sandbox. Browsers (especially closed source ones) and email clients are highly suggested candidates for sandboxing. A sandbox restricts an application to a limited set of safe directories and blocks access to the rest of the system.

​
When to Use FireJail

FireJail is particularly useful for:
  • Web browsers (Chrome, Firefox, Chromium)
  • Email clients (Evolution, Thunderbird)
  • Media players
  • Any application that processes untrusted content

​
Installation

1

Install FireJail

On Debian based systems:
sudo apt install firejail firejail-profiles
For Debian 10 Stable, the official backport is recommended:
sudo apt install -t buster-backports firejail firejail-profiles
2

Create symbolic links for applications

To run an application in a sandbox, create a symbolic link in /usr/local/bin that points to firejail.Examples for common applications:
sudo ln -s /usr/bin/firejail /usr/local/bin/google-chrome-stable
sudo ln -s /usr/bin/firejail /usr/local/bin/firefox
sudo ln -s /usr/bin/firejail /usr/local/bin/chromium
sudo ln -s /usr/bin/firejail /usr/local/bin/evolution
sudo ln -s /usr/bin/firejail /usr/local/bin/thunderbird
This works because /usr/local/bin typically appears before /usr/bin or /bin in your system’s PATH. When you launch the application, the system finds the symbolic link first and runs firejail instead.
3

Verify sandboxed applications

Run the application normally (via terminal or launcher), then check if it’s running in a jail:
firejail --list
You should see your sandboxed applications listed.

​
Managing Sandboxed Applications

​
Remove Sandboxing

To allow a sandboxed app to run normally again, simply remove the symbolic link: 
sudo rm /usr/local/bin/firefox

​
Custom Profiles

FireJail comes with pre-configured profiles for many applications. You can customize these profiles in: 
/etc/firejail/

​
How It Works

When you launch a sandboxed application:
  1. The system executes the firejail symbolic link
  2. FireJail reads the application name and loads the appropriate profile
  3. FireJail creates an isolated environment with:
    • Limited filesystem access
    • Restricted network capabilities (if configured)
    • Separate process namespace
  4. The application runs within these constraints

​
What This Provides

Filesystem Isolation

Applications can only access specific directories, preventing unauthorized file access

Process Isolation

Sandboxed processes are separated from the rest of the system

Network Control

Optional network restrictions can prevent unauthorized connections

Easy Management

Simple symlink-based activation and deactivation
Some applications may not function correctly when sandboxed, especially those requiring broad system access. Test thoroughly and remove sandboxing if issues arise.

Build docs developers (and LLMs) love

Get started for freeTalk to us