Firejail: Light, featureful and zero-dependency security sandbox for Linux

1. firejail

   1 142 5,980 9.6 C

   Linux namespaces and seccomp-bpf sandbox

   

   Firejail, Flatpak (which uses Bubblewrap under the hood), and Snap (which uses AppArmor) all use the same underlying technology: Linux namespaces.

   This question comes up a lot, and has been answered here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-...

   TL;DR: Firejail has much more comprehensive features than Flatpak (Bubblewrap). Firejail also has more comprehensive network support, support for AppArmor and SELinux, and easier seccomp filtering.

   Compared to Snap (which uses AppArmor), Firejail is compatible with AppArmor and again goes above and beyond with a lot of additional features.

2. Nutrient

   nutrient.io featured

   Nutrient - The #1 PDF SDK Library. Bad PDFs = bad UX. Slow load times, broken annotations, clunky UX frustrates users. Nutrient’s PDF SDKs gives seamless document experiences, fast rendering, annotations, real-time collaboration, 100+ features. Used by 10K+ devs, serving ~half a billion users worldwide. Explore the SDK for free.

   

3. nsjail

   2 7 3,115 5.7 C++

   A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.

   

4. tmux

   3 226 36,411 9.1 C

   tmux source code

   

   I think OpenBSD comes the closest to what you want with its two easy to use syscalls that provide syscall filtering and restricting access to paths:

   https://man.openbsd.org/pledge.2

   https://man.openbsd.org/unveil.2

   A few random examples:

   https://github.com/tmux/tmux/blob/c8494dff7b6b9a996866edaf8c...

   https://github.com/openbsd/ports/blob/master/www/mozilla-fir...

   https://github.com/openbsd/ports/blob/master/www/mozilla-fir...

   To get the best isolation you need to patch the source — the application needs to go through initial setup and then drop privileges to the absolute possible minimum. But it's easy to make custom wrappers for third-party applications — the above profiles taken from the OpenBSD ports tree are the proof.

5. ports

   4 14 511 10.0 Makefile

   Read-only git conversion of OpenBSD's official cvs ports repository. Pull requests not accepted - send diffs to the ports@ mailing list.

   

   I think OpenBSD comes the closest to what you want with its two easy to use syscalls that provide syscall filtering and restricting access to paths:

   https://man.openbsd.org/pledge.2

   https://man.openbsd.org/unveil.2

   A few random examples:

   https://github.com/tmux/tmux/blob/c8494dff7b6b9a996866edaf8c...

   https://github.com/openbsd/ports/blob/master/www/mozilla-fir...

   https://github.com/openbsd/ports/blob/master/www/mozilla-fir...

   To get the best isolation you need to patch the source — the application needs to go through initial setup and then drop privileges to the absolute possible minimum. But it's easy to make custom wrappers for third-party applications — the above profiles taken from the OpenBSD ports tree are the proof.

6. bubblewrap

   5 78 4,101 7.6 C

   Low-level unprivileged sandboxing tool used by Flatpak and similar projects

   

   While trying to find out more comparison information, found this light on details issue:

   https://github.com/containers/bubblewrap/issues/81

   It mentions nsjail and minijail.

7. CodeRabbit

   coderabbit.ai featured

   CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.

   

Suggest a related project