github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1539] New namespace setup time #1025

New issue

Closed

opened 2026-05-05 07:19:21 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 07:19:21 -06:00

Owner

Originally created by @jsm09a on GitHub (Sep 7, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1539

I have just deployed FireJail 0.9.48 and XPRA 2.03 on a new Debian Stretch (9.1) workstation install.

As shown by the following timings to launch a new FireFox instance, guarding against keystroke logging seems to be quite time consuming. These are repeated launches so that everything possible is already cached in memory (3.4 GHz Xeon with 32 GB ECC):

Native launch: 1.03 seconds
firejail firefox: 1.71 seconds
firejail --net firefox: 4.34 seconds !
firejail --x11=xpra: 4.55 seconds
firejail --x11=xpra --net=br0: 6.30 seconds :(

The XPRA setup time is unfortunate, but somewhat understandable in that a 276MB shared mmap buffer is set up, ... among other things.

But the time to set up a new Network Name Space seems somewhat excessive (to me ;). Is there anything that can be done to optimize the launch time for these configurations ?

Thanks, Scott.

Originally created by @jsm09a on GitHub (Sep 7, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1539 I have just deployed FireJail 0.9.48 and XPRA 2.03 on a new Debian Stretch (9.1) workstation install. As shown by the following timings to launch a new FireFox instance, guarding against keystroke logging seems to be quite time consuming. These are repeated launches so that everything possible is already cached in memory (3.4 GHz Xeon with 32 GB ECC): Native launch: 1.03 seconds firejail firefox: 1.71 seconds firejail --net firefox: 4.34 seconds ! firejail --x11=xpra: 4.55 seconds firejail --x11=xpra --net=br0: 6.30 seconds :( The XPRA setup time is unfortunate, but somewhat understandable in that a 276MB shared mmap buffer is set up, ... among other things. But the time to set up a new Network Name Space seems somewhat excessive (to me ;). Is there anything that can be done to optimize the launch time for these configurations ? Thanks, Scott.

gitea-mirror

2026-05-05 07:19:21 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:19:26 -06:00

Author

Owner

@Ferroin commented on GitHub (Sep 8, 2017):

I've never done any profiling myself, but I would not be surprised if at least part of that time is overhead in the kernel. There's actually a reasonable amount of allocation involved in setting up any type of namespace in the kernel (except possibly a UTS namespace), and of the various types, a net namespace is probably the most expensive to set up.

Part of it is probably also setup overhead to configure the network inside the namespace.

@Ferroin commented on GitHub (Sep 8, 2017): I've never done any profiling myself, but I would not be surprised if at least part of that time is overhead in the kernel. There's actually a reasonable amount of allocation involved in setting up any type of namespace in the kernel (except possibly a UTS namespace), and of the various types, a net namespace is probably the most expensive to set up. Part of it is probably also setup overhead to configure the network inside the namespace.

gitea-mirror commented

2026-05-05 07:19:28 -06:00

Author

Owner

@ghost commented on GitHub (Sep 8, 2017):

You can try to reconfigure xpra by disabling some options not needed when it runs on local machine. Read logs for more info.

@ghost commented on GitHub (Sep 8, 2017): You can try to reconfigure xpra by disabling some options not needed when it runs on local machine. Read logs for more info.

gitea-mirror commented

2026-05-05 07:19:30 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 14, 2017):

Native launch: 1.03 seconds

This is bad! It should be in tens of milliseconds. Grab firejail version 0.9.50 and run a simple bash session. I am printing up the startup time for the sandbox:

$ firejail
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 20379, child pid 20380
Child process initialized in 53.14 ms

53.ms for the sandbox itself. A sandbox with a network namespace will add one more second:

$ firejail --net=eth0
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 20395, child pid 20396

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP    
eth0-20395       5e:6c:52:e3:7c:fc  192.168.1.239    255.255.255.0    UP    
Default gateway 192.168.1.1

Child process initialized in 1062.98 ms

@netblue30 commented on GitHub (Sep 14, 2017): > Native launch: 1.03 seconds This is bad! It should be in tens of milliseconds. Grab firejail version 0.9.50 and run a simple bash session. I am printing up the startup time for the sandbox: ````` $ firejail Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc ** Note: you can use --noprofile to disable default.profile ** Parent pid 20379, child pid 20380 Child process initialized in 53.14 ms ````` 53.ms for the sandbox itself. A sandbox with a network namespace will add one more second: ````` $ firejail --net=eth0 Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc ** Note: you can use --noprofile to disable default.profile ** Parent pid 20395, child pid 20396 Interface MAC IP Mask Status lo 127.0.0.1 255.0.0.0 UP eth0-20395 5e:6c:52:e3:7c:fc 192.168.1.239 255.255.255.0 UP Default gateway 192.168.1.1 Child process initialized in 1062.98 ms `````

gitea-mirror commented

2026-05-05 07:19:32 -06:00

Author

Owner

@ghost commented on GitHub (Sep 16, 2017):

Native launch: 1.03 seconds
firejail firefox: 1.71 seconds

@netblue30 I believe that "Native launch" means it starts without firejail. Firejail adds 1.71-1.03=0.68 seconds which is quite similar to your results.

@ghost commented on GitHub (Sep 16, 2017): > Native launch: 1.03 seconds > firejail firefox: 1.71 seconds @netblue30 I believe that "Native launch" means it starts without firejail. Firejail adds 1.71-1.03=0.68 seconds which is quite similar to your results.

gitea-mirror commented

2026-05-05 07:19:34 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 18, 2017):

firejail firefox: 1.71 seconds
firejail --net firefox: 4.34 seconds !

I was expecting one second more for --net version. Could this be coming from DNS? Let's keep an eye on it.

@netblue30 commented on GitHub (Sep 18, 2017): > firejail firefox: 1.71 seconds > firejail --net firefox: 4.34 seconds ! I was expecting one second more for --net version. Could this be coming from DNS? Let's keep an eye on it.

gitea-mirror referenced this issue

2026-05-05 10:08:36 -06:00

[PR #1025] [MERGED] Add references to CVEs in release notes #3826

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1025

No description provided.

Rows
Columns