Firejail
A SUID Linux sandbox that confines desktop and server applications with namespaces, seccomp-bpf and capabilities, shipping around 1,350 application profiles. The convenient choice for confining desktop applications on a Linux laptop; not designed as a server-side sandbox primitive.
Overview
Firejail is a GPL-2.0 "lightweight security tool intended to protect a Linux system by setting up a restricted environment" for running untrusted applications. It is "an SUID sandbox program" that uses "Linux namespaces, seccomp-bpf and Linux capabilities" so that each sandboxed process tree gets its own view of the network stack, process table and mount table, and it can run alongside SELinux or AppArmor; Landlock support is marked experimental. You start a sandbox by prefixing a command with firejail, and firecfg integrates "over 900 default applications" with the desktop. The project is written in C with "virtually no dependencies" and runs "on any Linux computer with a 3.x kernel version or newer".
Unlike bubblewrap and nsjail, Firejail ships policy: its profile statistics report about 1,350 profiles, and the project site says sensitive data such as passwords and keys is blocked for more than 1,000 desktop applications. That makes it the quickest way to confine a browser an agent drives on a Linux desktop, but it is a workstation tool rather than a building block for a sandbox service: there is no API, no snapshotting and no orchestration, and its SUID design has a different trust model from unprivileged bubblewrap. Firejail 0.9.82.2 was released on 3 November 2026. No platform on this site documents building on Firejail.
Notable
- About 1,350 application profiles; desktop integration for over 900 applications via firecfg
- Firejail 0.9.82.2 released 3 November 2026 (0.9.82 on 2 November); GPL-2.0
- Runs on any Linux with a 3.x or newer kernel; Landlock support is experimental
Firejail specifications
| Attribute | Details |
|---|---|
| Isolation | SUID sandbox using Linux namespaces, seccomp-bpf and Linux capabilities, with per-application profiles and optional AppArmor and experimental Landlock integration |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (GPL-2.0) |
| SDKs and interfaces | CLI |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | None built in; profiles control which home and system paths are visible or private |
| GPU | Not documented |
| Networking | Each sandboxed process tree gets its own view of the network stack via namespaces; profiles can restrict or disable networking |
| Pricing | Free and open source |
| Free tier | Free to self-host |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Firejail’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want ready-made profiles for browsers and desktop applications rather than writing policy
- You run a coding agent or browser on a Linux workstation and want a one-word prefix to confine it
- You need something with no daemon and almost no dependencies
Trade-offs
- A SUID root binary, which widens the trusted computing base compared with unprivileged user-namespace tools
- Shares the host kernel; not a VM or user-space kernel boundary
- Desktop-oriented: no API, snapshots or orchestration for running sandboxes at scale
- Linux only
Good fit for: Confining a browser or desktop application on a Linux workstation with ready-made profiles.
How Firejail compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Firejail | Namespaces + seccomp | Yes | Yes / No | Not documented | Not documented | No / No | Not documented | CLI |
| bubblewrap | Linux namespaces | Yes | Yes / No | Not documented | Not documented | No / No | Not documented | CLI |
| nsjail | Namespaces + seccomp | Yes | Yes / No | Not documented | Configurable | No / No | Not documented | CLI |
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| gVisor | User-space kernel | Yes | Yes / No | ms (claim) | Not documented | Yes / Not documented | Yes | CLI |
| nono | Landlock / Seatbelt | Yes | No / No | Not documented | Not documented | Yes / Not documented | Not documented | CLI, Rust, Python, JavaScript/TypeScript, Go |
Frequently asked questions
What is Firejail?
How does Firejail isolate code?
Is Firejail open source?
How much does Firejail cost?
What are the alternatives to Firejail?
Sources
Cite this page
Agent Sandboxes. (2026). Firejail. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/firejail/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.