github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2589] Compare to nsjail #1646

New issue

Closed

opened 2026-05-05 08:17:49 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:17:49 -06:00

Owner

Originally created by @KOLANICH on GitHub (Mar 13, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2589

https://github.com/google/nsjail

Originally created by @KOLANICH on GitHub (Mar 13, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2589 https://github.com/google/nsjail

gitea-mirror closed this issue

2026-05-05 08:17:50 -06:00

gitea-mirror commented

2026-05-05 08:17:51 -06:00

Author

Owner

@veloute commented on GitHub (Mar 14, 2019):

at first glance, they're quite similar in the goals they're trying to accomplish.
a big difference i first noticed is that the profiles in nsjail are nowhere near as easy to read and understand as firejail's.

@veloute commented on GitHub (Mar 14, 2019): at first glance, they're quite similar in the goals they're trying to accomplish. a big difference i first noticed is that the profiles in nsjail are nowhere near as easy to read and understand as firejail's.

gitea-mirror commented

2026-05-05 08:17:52 -06:00

Author

Owner

@smitsohu commented on GitHub (Mar 14, 2019):

I don't know if nsjail was written to run safely as suid root. So just in case this is your plan, it might be a good idea to first ask over there at nsjail. Google was a heavy user of Ubuntu in the past, and since Ubuntu supported unprivileged user namespaces from the beginning, I wouldn't be surprised if nsjail, as an inhouse tool, was written primarily with unprivileged user namespaces in mind.

Other than that, nsjail and Firejail and all these tools try to be convenient interfaces to the same technologies in the kernel. It's not surprising there is a degree of similarity.

@smitsohu commented on GitHub (Mar 14, 2019): I don't know if nsjail was written to run safely as suid root. So just in case this is your plan, it might be a good idea to first ask over there at nsjail. Google was a heavy user of Ubuntu in the past, and since Ubuntu supported unprivileged user namespaces from the beginning, I wouldn't be surprised if nsjail, as an inhouse tool, was written primarily with unprivileged user namespaces in mind. Other than that, nsjail and Firejail and all these tools try to be convenient interfaces to the same technologies in the kernel. It's not surprising there is a degree of similarity.

gitea-mirror commented

2026-05-05 08:17:53 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 20, 2019):

Going to close since it looks like the OP's question was answered. @KOLANICH, please feel free to re-open if you have more questions.

@chiraag-nataraj commented on GitHub (May 20, 2019): Going to close since it looks like the OP's question was answered. @KOLANICH, please feel free to re-open if you have more questions.

gitea-mirror referenced this issue

2026-05-05 10:36:54 -06:00

[PR #5077] [MERGED] disable-common.inc: make ~/.config/pkcs11 read-only #5354

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1646

No description provided.

Rows
Columns