github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #189] Run Firejail in Docker container #131

New issue

Closed

opened 2026-05-05 05:08:09 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 05:08:09 -06:00

Owner

Originally created by @webslim on GitHub (Dec 7, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/189

Hi,
my way to use firejail is to 'su' to a user and then enter a sandbox with
firejail --noroot --caps.drop=all --seccomp --ipc-namespace
(If I want GUI separation, I do this in a Xephyr window.)
This used to work perfectly up to version 0.9.28.
The new version outputs a message about an existing sandbox and running without additional restrictions,
even though there is no other sandbox running. 'firejail --list' shows nothing.
I have a Grsecurity enabled kernel and came across https://github.com/netblue30/firejail/issues/141, but I am wondering why this used to work even though I have CONFIG_GRKERNSEC_PROC_USER=y. Did something change in the handling of /proc information?

Originally created by @webslim on GitHub (Dec 7, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/189 Hi, my way to use firejail is to 'su' to a user and then enter a sandbox with firejail --noroot --caps.drop=all --seccomp --ipc-namespace (If I want GUI separation, I do this in a Xephyr window.) This used to work perfectly up to version 0.9.28. The new version outputs a message about an existing sandbox and running without additional restrictions, even though there is no other sandbox running. 'firejail --list' shows nothing. I have a Grsecurity enabled kernel and came across https://github.com/netblue30/firejail/issues/141, but I am wondering why this used to work even though I have CONFIG_GRKERNSEC_PROC_USER=y. Did something change in the handling of /proc information?

gitea-mirror

2026-05-05 05:08:09 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:08:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 7, 2015):

I am still to investigate Grsecurity. Some people seem to be running fine, while others have problems.

"existing sandbox detected" is a warning. It means you are already in a firejail sandbox and attempt to start another firejail sandbox inside the current one. Things changed since 0.9.28, firejail sandboxes cannot be chained anymore. Instead, the program for the second sandbox is started as is in the existing sandbox.

I don't think there are any changes in /proc handling.

@netblue30 commented on GitHub (Dec 7, 2015): I am still to investigate Grsecurity. Some people seem to be running fine, while others have problems. "existing sandbox detected" is a warning. It means you are already in a firejail sandbox and attempt to start another firejail sandbox inside the current one. Things changed since 0.9.28, firejail sandboxes cannot be chained anymore. Instead, the program for the second sandbox is started as is in the existing sandbox. I don't think there are any changes in /proc handling.

gitea-mirror commented

2026-05-05 05:08:17 -06:00

Author

Owner

@tjanczuk commented on GitHub (Dec 16, 2015):

@netblue30 How is the determination made that firejail is running in an existing sandbox? I am getting the "Warning: an existing sandbox was detected" when running firejail from inside of a docker container (one started with --privileged=true).

@tjanczuk commented on GitHub (Dec 16, 2015): @netblue30 How is the determination made that firejail is running in an existing sandbox? I am getting the "Warning: an existing sandbox was detected" when running firejail from inside of a docker container (one started with --privileged=true).

gitea-mirror commented

2026-05-05 05:08:18 -06:00

Author

Owner

@tjanczuk commented on GitHub (Dec 16, 2015):

Looks like firejail is making this determination based on the presence of some kernel processes in the PID namespace. A workaround to run firejail in a docker container is to run docker in the host PID namespace (using --pid=host). If you can.

@tjanczuk commented on GitHub (Dec 16, 2015): Looks like firejail is making this determination based on the presence of some kernel processes in the PID namespace. A workaround to run firejail in a docker container is to run docker in the host PID namespace (using `--pid=host`). If you can.

gitea-mirror commented

2026-05-05 05:08:21 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 17, 2015):

If I understand correctly, you want to be able to run firejail in a Docker/LXC/whatever container. All I have to do is to disable the checking and let it running. I'll implement it for the next version. Thanks.

@netblue30 commented on GitHub (Dec 17, 2015): If I understand correctly, you want to be able to run firejail in a Docker/LXC/whatever container. All I have to do is to disable the checking and let it running. I'll implement it for the next version. Thanks.

gitea-mirror commented

2026-05-05 05:08:23 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 17, 2015):

I added a new command line option, --force, that disables the PID namespace checking. So, in a docker container run "firejail --force".

@netblue30 commented on GitHub (Dec 17, 2015): I added a new command line option, --force, that disables the PID namespace checking. So, in a docker container run "firejail --force".

gitea-mirror commented

2026-05-05 05:08:25 -06:00

Author

Owner

@tjanczuk commented on GitHub (Dec 17, 2015):

This is great, thanks! Is *.deb available for this already?

@tjanczuk commented on GitHub (Dec 17, 2015): This is great, thanks! Is *.deb available for this already?

gitea-mirror commented

2026-05-05 05:08:27 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 17, 2015):

Not yet, probably I'll make a new release in about one week.

@netblue30 commented on GitHub (Dec 17, 2015): Not yet, probably I'll make a new release in about one week.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#131

No description provided.

Rows
Columns