Firejail
Hacker ApprovedRanked 4 of 10 sandboxing tools by recommenders
Linux sandbox that isolates applications with fine-grained permissions and pre-made profiles for common programs. Critics say it is not bulletproof and needs root or SUID privilege.
Linux sandbox that isolates applications with fine-grained permissions and pre-made profiles for common programs. Critics say it is not bulletproof and needs root or SUID privilege.
36 people gave an opinion
- recommend it
- 30
- criticize it
- 6
- approval share
- 83%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 30 people recommend itNeeds 10 or more, met.
- 5 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Isolates desktop apps and agents
“Firejail seems like the right tool for a somewhat complicated desktop application that you want isolation for”
Comment from 27 Feb 2026 in “Don't run OpenClaw on your main machine” “just running the agent CLI in something like firejail would get you very far if you know what you're doing”
Comment from 16 Mar 2026 in “"How I write software with LLMs"” “you can run AI agents in Firejail to limit access to certain folders/files”
Comment from 12 Jan 2026 in “Cowork: Claude Code for the rest of your work” - Comment from 22 Feb 2026 in “Back to FreeBSD: Part 1”
- Comment from 1 Jan 2026 in “2025: The Year in LLMs”
Easy to configure and use
“sandboxing with Firejail and bwrap is quite easy to configure and allows fine-grained permissions”
Comment from 18 Apr 2026 in “Towards Trust in Emacs” “It seems simple enough to me.”
Comment from 9 Nov 2025 in “Using bubblewrap to add sandboxing to NetBSD” “They are really easy to use.”
Comment from 21 Jan 2026 in “Ask HN: Is Linux Safe to Daily drive in 2026?” - Comment from 9 Nov 2025 in “Using bubblewrap to add sandboxing to NetBSD”
- Comment from 3 Feb 2026 in “Notepad++ supply chain attack breakdown”
Works well in practice
“After a bit of tinkering I was able to get it to all run fine in Firejail”
Comment from 27 Dec 2025 in “Ask HN: How are you sandboxing coding agents?” “in firejail I never experienced a crash”
Comment from 15 Sep 2026 in “Ubuntu 26.10 completes transition to Rust-based coreutils” “Fore Linux firejail works well”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” - Comment from 9 Nov 2025 in “Using bubblewrap to add sandboxing to NetBSD”
Pre-made profiles for common apps
“I think firejail is a much more flexible security sandbox than bwrap. It also comes with pre-defined profiles”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” “which comes with a number of pre made profiles for common applications”
Comment from 27 Jun 2026 in “Enhancing X11 Application Security with LXC”
What people warn about
Each mark is one comment
Shares kernel; not bulletproof
“Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.”
Comment from 15 Aug 2026 in “Firefox is now the last major browser that still supports uBlock Origin” “Firejail is most likely not bullet-proof, although not soft by any stretch of the imagination”
Comment from 10 Nov 2025 in “Using bubblewrap to add sandboxing to NetBSD” “the general linux landscape lacks strong sandboxing, even if you use bwrap, firejail, etc.”
Comment from 9 Nov 2025 in “Using bubblewrap to add sandboxing to NetBSD” Needs root or SUID privilege
“firejail needs root privilege, so there are arguments that it may actually reduce the security”
Comment from 9 Nov 2025 in “Using bubblewrap to add sandboxing to NetBSD” “Firejail requires SUID, LandLock does not.”
Comment from 29 Nov 2025 in “Landlock-Ing Linux” Feels hacky and awkward
“it seemed to me it is very hacky and feels amateur-ish and doesn't make me trust it”
Comment from 10 Oct 2026 in “Telegram Desktop vulnerability allowed any user's file to be stolen” “it's a bit awkward really”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
Other sandboxing tools people recommend
The four most recommended other sandboxing tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bubblewrap (bwrap) | 109 | 32 | 77% | 12 | — | Approved |
| Agent Safehouse | 43 | 2 | 96% | 7 | — | Approved |
| nono | 34 | 3 | 92% | 10 | — | Approved |
| FirejailThis page | 30 | 6 | 83% | 12 | — | Approved |
| sandbox-exec | 25 | 7 | 78% | 11 | — | Approved |
What people said
40 of the 51 comments that mention it, newest first. Each links to the original comment.
“where I containerize most things, as well as firejail etc.”
“it seemed to me it is very hacky and feels amateur-ish and doesn't make me trust it”
“some people feel better using stuff like bubblewrap/fire jail”
“I am switching to using one firejail per project”
“I am switching to using one firejail per project to containerize as much as possible”
“in firejail I never experienced a crash”
“Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.”
“since you have more direct control over the OS level controls that are being leveraged by various container solutions anyways”
“you should be running the browser inside firejail at all times”
“which comes with a number of pre made profiles for common applications”
“Add in Firejail if you want environment isolation.”
“sandboxing with Firejail and bwrap is quite easy to configure and allows fine-grained permissions”
“it's a bit awkward really”
“I think firejail is a much more flexible security sandbox than bwrap. It also comes with pre-defined profiles”
“What they get access to is very limited, and mostly whitelisted.”
“I am a heavy user of Firejail and bwrap”
“I am a heavy user of Firejail and bwrap.”
“just running the agent CLI in something like firejail would get you very far if you know what you're doing”
“Fore Linux firejail works well”
“Flatpak, Bubblewrap, and Firejail each provide an overall fuller view of what sandboxing can be.”
“Firejail is a good start, but proper user isolation as Android does is the right solution”
“Firejail seems like the right tool for a somewhat complicated desktop application that you want isolation for”
“I use firejail to isolate a couple of proprietary desktop applications”
“They are quite easy to use.”
“The tools to do so are there (e.g. Nix and firejail/bwrap) and, unlike Wayland, they play well with existing software.”
“that starts to degrade performance in noticeable ways”
“They are really easy to use.”
“NixOS and GuixSD make it quite trivial to sandbox applications in a declarative fashion using firejail”
“a lot less to type and seems to work extremely similarly”
“you can run AI agents in Firejail to limit access to certain folders/files”
“perhaps look at something like firejail or read more about systemd”
“I was able to run agents in Firejail”
“After a bit of tinkering I was able to get it to all run fine in Firejail”
“Run your shit in firejail or bubblewrap”
“Firejail requires SUID, LandLock does not.”
“Firejail is most likely not bullet-proof, although not soft by any stretch of the imagination”
“It seems simple enough to me.”
“the general linux landscape lacks strong sandboxing, even if you use bwrap, firejail, etc.”
“firejail needs root privilege, so there are arguments that it may actually reduce the security”
“It seem to work well for me.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.