Firejail: Light, featureful and zero-dependency security sandbox for Linux

See also Bubblewrap[1]. I use Bubblewrap all the time, because it's just useful, and a bit easier than doing things with unshare directly. To compare and contrast: bubblewrap is lower level, and is great for embedding or using in one-off invocations, whereas firejail is more oriented towards adding a bit of hardening to everyday applications like Firefox via built-in and custom profiles. For example, you could temporarily override a path doing something like this: bwrap --bind / / --bind /tmp/myoverride…

Just a reminder that seccomp is available to all the applications, and if you include it in the app itself, you can limit the privileges much better than firejail can. For example apps don't usually need to read config, or don't need to open new listening sockets once their initialised. This can be easily done in the app, but not by firejail. I'm quite disappointed projects don't integrate that functionality upstream. The only popular one I know of is chrome.