github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2284] firejail always detects a sandbox when running under WSL #1523

New issue

Closed

opened 2026-05-05 08:11:08 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 08:11:08 -06:00

Owner

Originally created by @mqudsi on GitHub (Dec 1, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2284

I'm unable to use firejail (to test for app compatibility) due to it always thinking it's running in a sandbox anytime I run it under WSL.

mqudsi@Blitzkrieg /m/d/r/fish> firejail --shell=build/fish
Warning: shell-related command line options are disregarded - using SHELL environment variable
Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features
mqudsi@Blitzkrieg:/mnt/d/rand/fish$ exit
exit
mqudsi@Blitzkrieg /m/d/r/fish> uname -a
Linux Blitzkrieg 4.4.0-17763-Microsoft #55-Microsoft Sat Oct 06 18:05:00 PST 2018 x86_64 x86_64 x86_64 GNU/Linux
mqudsi@Blitzkrieg /m/d/r/fish> firejail --version
firejail version 0.9.57

Originally created by @mqudsi on GitHub (Dec 1, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2284 I'm unable to use firejail (to test for app compatibility) due to it always thinking it's running in a sandbox anytime I run it under WSL. ``` mqudsi@Blitzkrieg /m/d/r/fish> firejail --shell=build/fish Warning: shell-related command line options are disregarded - using SHELL environment variable Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features mqudsi@Blitzkrieg:/mnt/d/rand/fish$ exit exit mqudsi@Blitzkrieg /m/d/r/fish> uname -a Linux Blitzkrieg 4.4.0-17763-Microsoft #55-Microsoft Sat Oct 06 18:05:00 PST 2018 x86_64 x86_64 x86_64 GNU/Linux mqudsi@Blitzkrieg /m/d/r/fish> firejail --version firejail version 0.9.57 ```

gitea-mirror

2026-05-05 08:11:08 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 08:11:11 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Dec 1, 2018):

I don't think WSL actually implements any of the kernel features that firejail needs, because it isn't actually running the Linux kernel.

That being said the error message should probably be tweaked for different cases like this.

@SkewedZeppelin commented on GitHub (Dec 1, 2018): I don't think WSL actually implements any of the kernel features that firejail needs, because it isn't actually running the Linux kernel. That being said the error message should probably be tweaked for different cases like this.

gitea-mirror commented

2026-05-05 08:11:12 -06:00

Author

Owner

@crass commented on GitHub (Jan 8, 2019):

While I highly doubt WSL implements the needed kernel container APIs, as far as I can tell, firejail doesn't actually check for the APIs. It first checks the "container" envvar (see check_namespace_virt) and if not in a container white list, checks if its in a pid namespace by seeing if any of a list of 5 kernel process names exist in /proc (see check_kernel_procs). I suspect firejail isn't finding a matching kernel process name. If you run with --debug, I believe more info confirming this will be shown.

This seems list a pretty hacky/error-prone way of doing this, but I'm not terribly interested in this use case, especially since the underlying APIs likely aren't there anyway.

@crass commented on GitHub (Jan 8, 2019): While I highly doubt WSL implements the needed kernel container APIs, as far as I can tell, firejail doesn't actually check for the APIs. It first checks the "container" envvar (see `check_namespace_virt`) and if not in a container white list, checks if its in a pid namespace by seeing if any of a list of 5 kernel process names exist in /proc (see `check_kernel_procs`). I suspect firejail isn't finding a matching kernel process name. If you run with `--debug`, I believe more info confirming this will be shown. This seems list a pretty hacky/error-prone way of doing this, but I'm not terribly interested in this use case, especially since the underlying APIs likely aren't there anyway.

gitea-mirror commented

2026-05-05 08:11:13 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 21, 2019):

Let's go ahead and close this as wontfix for now (although apparently WSL 2 will actually run a Linux kernel? That may very well change the situation).

@chiraag-nataraj commented on GitHub (May 21, 2019): Let's go ahead and close this as wontfix for now (although apparently WSL 2 will actually run a Linux kernel? That may very well change the situation).

gitea-mirror commented

2026-05-05 08:11:13 -06:00

Author

Owner

@erndob commented on GitHub (Jan 5, 2020):

To anyone reading this, WSL 2 doesn't work either. At least the 19041 build.

@erndob commented on GitHub (Jan 5, 2020): To anyone reading this, WSL 2 doesn't work either. At least the 19041 build.

gitea-mirror commented

2026-05-05 08:11:14 -06:00

Author

Owner

@agnosticlines commented on GitHub (Nov 7, 2023):

Hey sorry to bump this old issue but I've compiled a custom kernel with everything needed for firejail, apparmor, selinux, etc and now running into this, is there any workaround for this?

@agnosticlines commented on GitHub (Nov 7, 2023): Hey sorry to bump this old issue but I've compiled a custom kernel with everything needed for firejail, apparmor, selinux, etc and now running into this, is there any workaround for this?

gitea-mirror commented

2026-05-05 08:11:14 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 7, 2023):

Try to start with container=lxc.

@rusty-snake commented on GitHub (Nov 7, 2023): Try to start with `container=lxc`.

gitea-mirror commented

2026-05-05 08:11:15 -06:00

Author

Owner

@agnosticlines commented on GitHub (Nov 7, 2023):

Try to start with container=lxc.

Yep that works! Although now running into a weird issue where it takes like over 60 seconds to launch if I give it a profile, --noprofile is instant, will look into that. Thanks though!

@agnosticlines commented on GitHub (Nov 7, 2023): > Try to start with `container=lxc`. Yep that works! Although now running into a weird issue where it takes like over 60 seconds to launch if I give it a profile, --noprofile is instant, will look into that. Thanks though!

gitea-mirror referenced this issue

2026-05-05 10:11:59 -06:00

[PR #1523] [MERGED] add smtube (add-on for smplayer) to private-bin #4004

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1523

No description provided.

Rows
Columns