[GH-ISSUE #151] Disabled network in overlay mode.

gitea-mirror commented

2026-05-05 05:02:07 -06:00

Owner

Originally created by @Javapraca on GitHub (Nov 20, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/151

I cannot access network when running Firejail in overlay mode. I tested versions: firejail_0.9.34_1_i386.deb and firejail_0.9.32_1_i386.deb on Ubuntu 14.04.3 (LTS), installed on computer with Atom CPU.

By the way I would like to thank you for developing Firejail - it is a great software, I use it every day.

The following logs come from Firejail version 0.9.32

ubuntu@ubuntu:~$ firejail --overlay firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-history.inc
Parent pid 2069, child pid 2070
OverlayFS configured in /home/ubuntu/.firejail/2069 directory
Warning: failed to unmount /sys
Error: cannot mount a new user namespace
unshare: Operation not permitted
Error: cannot write to /proc/2070/uid_map: Operation not permitted
ubuntu@ubuntu:~$ Error: cannot establish communication with the parent, exiting...

ubuntu@ubuntu:~$ firejail --debug --overlay firefox 2>&1 >bug.txt
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-history.inc
Warning: failed to unmount /sys
Error: cannot mount a new user namespace
unshare: Operation not permitted
Error: cannot write to /proc/2532/uid_map: Operation not permitted
Error: cannot establish communication with the parent, exiting...

bug.txt

In this case one can run firefox/ping/etc. but there is no network connection:

ubuntu@ubuntu:~/Pobrane$ firejail --debug --overlay
Command name #bash#
Warning: default profile disabled by --overlay option
Using the local network stack
Parent pid 2634, child pid 2635
Initializing child process
PID namespace installed
Mounting tmpfs on /tmp/firejail/mnt directory
Linux kernel version 3.19
Mounting OverlayFS
OverlayFS configured in /home/ubuntu/.firejail/2634 directory
Mounting /dev
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/dhcp
Mounting tmpfs on /var/lib/snmp
Mounting tmpfs on /var/lib/sudo
Create the new utmp file
Mount the new utmp file
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
Warning: failed to unmount /sys
Disable /sys/firmware directory
Disable /sys/hypervisor directory
Disable /sys/fs directory
Disable /sys/module directory
Disable /sys/power directory
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /sys/kernel/uevent_helper
Disable /proc/irq
Disable /proc/bus
Disable /proc/kcore
Disable /proc/kallsyms
Mounting a new /boot directory
Disable /dev/port
Username ubuntu, groups 1000, 4, 24, 27, 30, 46, 108, 124, 
Starting /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: /bin/bash
Child process initialized

Originally created by @Javapraca on GitHub (Nov 20, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/151 I cannot access network when running Firejail in overlay mode. I tested versions: **firejail_0.9.34_1_i386.deb** and **firejail_0.9.32_1_i386.deb** on **Ubuntu 14.04.3 (LTS)**, installed on computer with Atom CPU. By the way I would like to thank you for developing Firejail - it is a great software, I use it every day. The following logs come from Firejail version 0.9.32 ``` ubuntu@ubuntu:~$ firejail --overlay firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-history.inc Parent pid 2069, child pid 2070 OverlayFS configured in /home/ubuntu/.firejail/2069 directory Warning: failed to unmount /sys Error: cannot mount a new user namespace unshare: Operation not permitted Error: cannot write to /proc/2070/uid_map: Operation not permitted ubuntu@ubuntu:~$ Error: cannot establish communication with the parent, exiting... ``` --- ``` ubuntu@ubuntu:~$ firejail --debug --overlay firefox 2>&1 >bug.txt Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-history.inc Warning: failed to unmount /sys Error: cannot mount a new user namespace unshare: Operation not permitted Error: cannot write to /proc/2532/uid_map: Operation not permitted Error: cannot establish communication with the parent, exiting... ``` [bug.txt](https://github.com/netblue30/firejail/files/40539/bug.txt) --- **In this case one can run firefox/ping/etc. but there is no network connection:** ``` ubuntu@ubuntu:~/Pobrane$ firejail --debug --overlay Command name #bash# Warning: default profile disabled by --overlay option Using the local network stack Parent pid 2634, child pid 2635 Initializing child process PID namespace installed Mounting tmpfs on /tmp/firejail/mnt directory Linux kernel version 3.19 Mounting OverlayFS OverlayFS configured in /home/ubuntu/.firejail/2634 directory Mounting /dev Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Mounting tmpfs on /var/lib/dhcp Mounting tmpfs on /var/lib/snmp Mounting tmpfs on /var/lib/sudo Create the new utmp file Mount the new utmp file Remounting /proc and /proc/sys filesystems Remounting /sys directory Warning: failed to unmount /sys Disable /sys/firmware directory Disable /sys/hypervisor directory Disable /sys/fs directory Disable /sys/module directory Disable /sys/power directory Disable /proc/sysrq-trigger Disable /proc/sys/kernel/hotplug Disable /sys/kernel/uevent_helper Disable /proc/irq Disable /proc/bus Disable /proc/kcore Disable /proc/kallsyms Mounting a new /boot directory Disable /dev/port Username ubuntu, groups 1000, 4, 24, 27, 30, 46, 108, 124, Starting /bin/bash execvp argument 0: /bin/bash execvp argument 1: -c execvp argument 2: /bin/bash Child process initialized ```

gitea-mirror

2026-05-05 05:02:07 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:02:12 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 20, 2015):

From 0.9.32 to 0.9.34 quite a number of bugs have been fixed. I would suggest you move to version 0.9.34.

There seem to be a problem with user namespaces in your kernel, so for now let's try to get around it. Instead of "firejail --overlay firefox", try:

$ firejail --overlay --ignore=noroot firefox

This disables user namespace. I'll do some more testing here, maybe I can understand what is going on. Network should work with overlayfs. Thanks for the bug.

@netblue30 commented on GitHub (Nov 20, 2015): From 0.9.32 to 0.9.34 quite a number of bugs have been fixed. I would suggest you move to version 0.9.34. There seem to be a problem with user namespaces in your kernel, so for now let's try to get around it. Instead of "firejail --overlay firefox", try: ``` $ firejail --overlay --ignore=noroot firefox ``` This disables user namespace. I'll do some more testing here, maybe I can understand what is going on. Network should work with overlayfs. Thanks for the bug.

gitea-mirror commented

2026-05-05 05:02:14 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 21, 2015):

It works fine with "--overlay --ignore=noroot" (tested on version 0.9.34).

I am a bit surprised though - in the Firejail manual you wrote about "--noroot" option: "The option is not supported for --chroot and --overlay configurations, or for sandboxes started as root.", so I thought that "--noroot" and "--overlay" are mutually exclusive.

Outputs for firejail 0.9.34 (executed without "--ignore=noroot" option) look similar to the ones I have already added (version 0.9.32) - would you want me to paste them?

@Javapraca commented on GitHub (Nov 21, 2015): It works fine with "--overlay --ignore=noroot" (tested on version 0.9.34). I am a bit surprised though - in the Firejail manual you wrote about "--noroot" option: "The option is not supported for --chroot and --overlay configurations, or for sandboxes started as root.", so I thought that "--noroot" and "--overlay" are mutually exclusive. Outputs for firejail 0.9.34 (executed without "--ignore=noroot" option) look similar to the ones I have already added (version 0.9.32) - would you want me to paste them?

gitea-mirror commented

2026-05-05 05:02:18 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 21, 2015):

UPDATE:
Command: $ firejail --overlay --ignore=noroot firefox does not work. It runs Firefox with access to the network but only when another Firefox instance is already running (otherwise there is no network access).

@Javapraca commented on GitHub (Nov 21, 2015): UPDATE: Command: `$ firejail --overlay --ignore=noroot firefox` does not work. It runs Firefox with access to the network but only when another Firefox instance is already running (otherwise there is no network access).

gitea-mirror commented

2026-05-05 05:02:20 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 23, 2015):

I've fixed the first problem:

$ firejail --overlay firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/whitelist-common.inc
Warning: --overlay and --noroot are mutually exclusive, noroot disabled
Parent pid 3266, child pid 3267
OverlayFS configured in /home/netblue/.firejail/3266 directory
Warning: cannot find /var/run/utmp
Warning: failed to unmount /sys
Child process initialized

Let's look into the network problem. I need you to do a test. Start the sandbox and do a /sbin/ifconfig followed by a ping and post the output here:

$ firejail --noprofile --overlay
Parent pid 3304, child pid 3305
OverlayFS configured in /home/netblue/.firejail/3304 directory
Warning: cannot find /var/run/utmp
Warning: failed to unmount /sys
Child process initialized
[netblue@debian ~]$ /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr e0:3f:49:7a:14:09  
          inet addr:192.168.1.60  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::e23f:49ff:fe7a:1409/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:14549 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10462 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:19697699 (18.7 MiB)  TX bytes:944207 (922.0 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:4 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:342 (342.0 B)  TX bytes:342 (342.0 B)

[netblue@debian ~]$ ping google.com
PING google.com (74.125.226.168) 56(84) bytes of data.
64 bytes from lga15s45-in-f8.1e100.net (74.125.226.168): icmp_req=1 ttl=54 time=2466 ms

Thanks.

@netblue30 commented on GitHub (Nov 23, 2015): I've fixed the first problem: ``` $ firejail --overlay firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/whitelist-common.inc Warning: --overlay and --noroot are mutually exclusive, noroot disabled Parent pid 3266, child pid 3267 OverlayFS configured in /home/netblue/.firejail/3266 directory Warning: cannot find /var/run/utmp Warning: failed to unmount /sys Child process initialized ``` Let's look into the network problem. I need you to do a test. Start the sandbox and do a /sbin/ifconfig followed by a ping and post the output here: ``` $ firejail --noprofile --overlay Parent pid 3304, child pid 3305 OverlayFS configured in /home/netblue/.firejail/3304 directory Warning: cannot find /var/run/utmp Warning: failed to unmount /sys Child process initialized [netblue@debian ~]$ /sbin/ifconfig eth0 Link encap:Ethernet HWaddr e0:3f:49:7a:14:09 inet addr:192.168.1.60 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::e23f:49ff:fe7a:1409/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:14549 errors:0 dropped:0 overruns:0 frame:0 TX packets:10462 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:19697699 (18.7 MiB) TX bytes:944207 (922.0 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:4 errors:0 dropped:0 overruns:0 frame:0 TX packets:4 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:342 (342.0 B) TX bytes:342 (342.0 B) [netblue@debian ~]$ ping google.com PING google.com (74.125.226.168) 56(84) bytes of data. 64 bytes from lga15s45-in-f8.1e100.net (74.125.226.168): icmp_req=1 ttl=54 time=2466 ms ``` Thanks.

gitea-mirror commented

2026-05-05 05:02:24 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 26, 2015):

Here is the output you wanted:

ubuntu@ubuntu:~$ firejail --noprofile --overlay
Parent pid 2078, child pid 2079
OverlayFS configured in /home/ubuntu/.firejail/2078 directory
Warning: failed to unmount /sys
Child process initialized
[ubuntu@ubuntu ~]$ /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr f4:6d:04:2f:00:d4  
          inet6 addr: fe80::f66d:4ff:fe2f:d4/64 Scope:Link
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:7
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:465 errors:0 dropped:0 overruns:0 frame:0
          TX packets:465 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:46093 (46.0 KB)  TX bytes:46093 (46.0 KB)

wlan0     Link encap:Ethernet  HWaddr e0:b9:a5:5c:db:89  
          inet addr:192.168.1.4  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::e2b9:a5ff:fe5c:db89/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4514 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3266 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:5564584 (5.5 MB)  TX bytes:458349 (458.3 KB)

[ubuntu@ubuntu ~]$ ping google.com
ping: unknown host google.com

@Javapraca commented on GitHub (Nov 26, 2015): Here is the output you wanted: ``` ubuntu@ubuntu:~$ firejail --noprofile --overlay Parent pid 2078, child pid 2079 OverlayFS configured in /home/ubuntu/.firejail/2078 directory Warning: failed to unmount /sys Child process initialized [ubuntu@ubuntu ~]$ /sbin/ifconfig eth0 Link encap:Ethernet HWaddr f4:6d:04:2f:00:d4 inet6 addr: fe80::f66d:4ff:fe2f:d4/64 Scope:Link UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:7 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:465 errors:0 dropped:0 overruns:0 frame:0 TX packets:465 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:46093 (46.0 KB) TX bytes:46093 (46.0 KB) wlan0 Link encap:Ethernet HWaddr e0:b9:a5:5c:db:89 inet addr:192.168.1.4 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::e2b9:a5ff:fe5c:db89/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:4514 errors:0 dropped:0 overruns:0 frame:0 TX packets:3266 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:5564584 (5.5 MB) TX bytes:458349 (458.3 KB) [ubuntu@ubuntu ~]$ ping google.com ping: unknown host google.com ```

gitea-mirror commented

2026-05-05 05:02:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 26, 2015):

I know what the problem is: --net doesn't work for wireless interfaces. I works only for regular wired Ethernet interfaces - wireless doesn't have support in the kernel for some features I need in the network namespace.

@netblue30 commented on GitHub (Nov 26, 2015): I know what the problem is: --net doesn't work for wireless interfaces. I works only for regular wired Ethernet interfaces - wireless doesn't have support in the kernel for some features I need in the network namespace.

gitea-mirror commented

2026-05-05 05:02:32 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 26, 2015):

On my other computer (also connected via WiFi) I am using similar configuration with Firejail version 0.9.28 and Ubuntu 12.04.2 LTS - and there is network connection inside Firejail sandbox. How it is possible?

@Javapraca commented on GitHub (Nov 26, 2015): On my other computer (also connected via WiFi) I am using similar configuration with Firejail version 0.9.28 and Ubuntu 12.04.2 LTS - and there is network connection inside Firejail sandbox. How it is possible?

gitea-mirror commented

2026-05-05 05:02:35 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 26, 2015):

With all due respect :) - have you tried this concept:
http://superuser.com/questions/653996/how-to-move-wireless-connection-to-other-network-namespace

@Javapraca commented on GitHub (Nov 26, 2015): With all due respect :) - have you tried this concept: http://superuser.com/questions/653996/how-to-move-wireless-connection-to-other-network-namespace

gitea-mirror commented

2026-05-05 05:02:38 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 26, 2015):

And one more idea - would it be possible/safe to add a parameter to disable network namespaces inside the sandbox (in case one uses WiFi connection e.g.)?

@Javapraca commented on GitHub (Nov 26, 2015): And one more idea - would it be possible/safe to add a parameter to disable network namespaces inside the sandbox (in case one uses WiFi connection e.g.)?

gitea-mirror commented

2026-05-05 05:02:40 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 27, 2015):

Maybe is the DNS setting, try this command:

$ firejail --noprofile --overlay --dns=8.8.8.8

Also, do a "netstat -rn" inside the sandbox, just to make sure the default gateway is configured.

To disable network namespace use --net=none:

$ firejail --net=none

@netblue30 commented on GitHub (Nov 27, 2015): Maybe is the DNS setting, try this command: ``` $ firejail --noprofile --overlay --dns=8.8.8.8 ``` Also, do a "netstat -rn" inside the sandbox, just to make sure the default gateway is configured. To disable network namespace use --net=none: ``` $ firejail --net=none ```

gitea-mirror commented

2026-05-05 05:02:42 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 27, 2015):

Yes, this is problem with default DNS inside "--overlay" sandbox. Command:
firejail --overlay --dns=8.8.8.8 works fine (--noprofile option can be skipped). When I set --dns option to DNS IP given by nm-tool command or DNS IP from /etc/resolv.conf then it works as well. Maybe Firejail in default overlay mode denies access to some expected DNS configuration data (I have checked that nm-tool and /etc/resolv.conf do not give information about DNS in this case)?

PS. firejail --net=none - "Enable a new, unconnected network namespace." (quote from manual) and does not "disable network namespace". It does not help with "--overlay" problem anyway, but it would be really handy to have an option to disable network namespace.

@Javapraca commented on GitHub (Nov 27, 2015): Yes, this is problem with default DNS inside "--overlay" sandbox. Command: `firejail --overlay --dns=8.8.8.8` works fine (--noprofile option can be skipped). When I set --dns option to DNS IP given by nm-tool command or DNS IP from /etc/resolv.conf then it works as well. Maybe Firejail in default overlay mode denies access to some expected DNS configuration data (I have checked that nm-tool and /etc/resolv.conf do not give information about DNS in this case)? PS. `firejail --net=none` - "Enable a new, unconnected network namespace." (quote from manual) and does not "disable network namespace". It does not help with "--overlay" problem anyway, but it would be really handy to have an option to disable network namespace.

gitea-mirror commented

2026-05-05 05:02:45 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 28, 2015):

I think Ubuntu runs a DNS proxy, and somehow the proxy clashes with --overlay. I don't see it here on my Ubuntu boxes (all 64bit). I'll try to get a 32bit Ubuntu install, I'll add it on my todo list.

For now stay with "--dns=8.8.8.8 --dns=8.8.4.4" - usually two DNS servers are used, just in case one of them goes down.

--network=none - There is no way to disable the networking subsystem once it is compiled into the kernel. The next best thing is to have it unconnected.

@netblue30 commented on GitHub (Nov 28, 2015): I think Ubuntu runs a DNS proxy, and somehow the proxy clashes with --overlay. I don't see it here on my Ubuntu boxes (all 64bit). I'll try to get a 32bit Ubuntu install, I'll add it on my todo list. For now stay with "--dns=8.8.8.8 --dns=8.8.4.4" - usually two DNS servers are used, just in case one of them goes down. --network=none - There is no way to disable the networking subsystem once it is compiled into the kernel. The next best thing is to have it unconnected.

gitea-mirror commented

2026-05-05 05:02:47 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 28, 2015):

So in this scenario you do not create a new network namespace in the sandbox?

@Javapraca commented on GitHub (Nov 28, 2015): So in this scenario you do not create a new network namespace in the sandbox?

gitea-mirror commented

2026-05-05 05:02:49 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 28, 2015):

No, by default is not creating a network namespace, is just reusing the existing one. To create a network namespace you use --net=interface_name, something like this:

$ firejail --net=eth0

--net accepts only ethernet or bridge interfaces, it will not work with wireless.

@netblue30 commented on GitHub (Nov 28, 2015): No, by default is not creating a network namespace, is just reusing the existing one. To create a network namespace you use --net=interface_name, something like this: ``` $ firejail --net=eth0 ``` --net accepts only ethernet or bridge interfaces, it will not work with wireless.

gitea-mirror commented

2026-05-05 05:02:51 -06:00

Author

Owner

@Javapraca commented on GitHub (Nov 28, 2015):

I was convinced that new network namespace is created with every sandbox instance. Thank you for explanation.

@Javapraca commented on GitHub (Nov 28, 2015): I was convinced that new network namespace is created with every sandbox instance. Thank you for explanation.

Rows
Columns

[GH-ISSUE #151] Disabled network in overlay mode. #101