github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2721] Is it possible to create a new file virutal filesystem and isolate it from the main operating system? #1713

New issue

Closed

opened 2026-05-05 08:22:19 -06:00 by gitea-mirror · 9 comments

gitea-mirror commented

2026-05-05 08:22:19 -06:00

Owner

Originally created by @Raj2032 on GitHub (May 23, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2721

Is it possible to create a new file virtual filesystem and isolate it from the main operating system using firejail?

Originally created by @Raj2032 on GitHub (May 23, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2721 Is it possible to create a new file virtual filesystem and isolate it from the main operating system using firejail?

gitea-mirror

2026-05-05 08:22:19 -06:00

closed this issue
added the
information_old

question_old
labels

gitea-mirror commented

2026-05-05 08:22:23 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 23, 2019):

In what context? You could use --overlay-tmpfs, for example, depending on what you're trying to do.

@chiraag-nataraj commented on GitHub (May 23, 2019): In what context? You could use `--overlay-tmpfs`, for example, depending on what you're trying to do.

gitea-mirror commented

2026-05-05 08:22:24 -06:00

Author

Owner

@Raj2032 commented on GitHub (May 23, 2019):

So I want to install an application in a virtual environment, so I wanted to know if you can create a filesystem and this filesystem is isolated and cannot access the main operating system's files and any other resources. Does --overlay-tmpfs do what I want it to do?

Also with these virtual file systems, is it stored as a file on the main file system?

@Raj2032 commented on GitHub (May 23, 2019): So I want to install an application in a virtual environment, so I wanted to know if you can create a filesystem and this filesystem is isolated and cannot access the main operating system's files and any other resources. Does `--overlay-tmpfs` do what I want it to do? Also with these virtual file systems, is it stored as a file on the main file system?

gitea-mirror commented

2026-05-05 08:22:25 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 23, 2019):

@Raj2032 you may sould consider to use a VM. If you want to use firejail you can use the --chroot option (https://firejail.wordpress.com/documentation-2/basic-usage/#chroot), then you still need to protect the kernel like firejail --noprofile --seccomp --chroot=/your/chroot program

@rusty-snake commented on GitHub (May 23, 2019): @Raj2032 you may sould consider to use a VM. If you want to use firejail you can use the `--chroot` option (https://firejail.wordpress.com/documentation-2/basic-usage/#chroot), then you still need to protect the kernel like `firejail --noprofile --seccomp --chroot=/your/chroot program`

gitea-mirror commented

2026-05-05 08:22:26 -06:00

Author

Owner

@Raj2032 commented on GitHub (May 23, 2019):

@rusty-snake I don't want to use VM as that is too slow.

Whats the difference between --overlay-tmpfs and --chroot?

@Raj2032 commented on GitHub (May 23, 2019): @rusty-snake I don't want to use VM as that is too slow. Whats the difference between `--overlay-tmpfs` and `--chroot`?

gitea-mirror commented

2026-05-05 08:22:27 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 23, 2019):

--chroot=dirname
Chroot the sandbox into a root filesystem. Unlike the regular
filesystem container, the system directories are mounted read-
write. If the sandbox is started as a regular user, default
seccomp and capabilities filters are enabled.

--overlay-tmpfs
Mount a filesystem overlay on top of the current filesystem.
All filesystem modifications are discarded when the sandbox is
closed. Directories /run, /tmp and /dev are not covered by the
overlay. If the sandbox is started as a regular user, default
seccomp and capabilities filters are enabled.

--overlay-named=name
Mount a filesystem overlay on top of the current filesystem.
Unlike the regular filesystem container, the system directories
are mounted read-write. All filesystem modifications go into
the overlay. Directories /run, /tmp and /dev are not covered
by the overlay. The overlay is stored in $HOME/.firejail/
directory. The created overlay can be reused between multiple
sessions. If the sandbox is started as a regular user, default
seccomp and capabilities filters are enabled.

@rusty-snake commented on GitHub (May 23, 2019): > --chroot=dirname Chroot the sandbox into a root filesystem. Unlike the regular filesystem container, the system directories are mounted read- write. If the sandbox is started as a regular user, default seccomp and capabilities filters are enabled. > --overlay-tmpfs Mount a filesystem overlay on top of the current filesystem. All filesystem modifications are discarded when the sandbox is closed. Directories /run, /tmp and /dev are not covered by the overlay. If the sandbox is started as a regular user, default seccomp and capabilities filters are enabled. > --overlay-named=name Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container, the system directories are mounted read-write. All filesystem modifications go into the overlay. Directories /run, /tmp and /dev are not covered by the overlay. The overlay is stored in $HOME/.firejail/ directory. The created overlay can be reused between multiple sessions. If the sandbox is started as a regular user, default seccomp and capabilities filters are enabled.

gitea-mirror commented

2026-05-05 08:22:27 -06:00

Author

Owner

@Raj2032 commented on GitHub (May 24, 2019):

@rusty-snake Thanks man one last question, using firejail chroot, can you have multiple filesystems?

@Raj2032 commented on GitHub (May 24, 2019): @rusty-snake Thanks man one last question, using firejail chroot, can you have multiple filesystems?

gitea-mirror commented

2026-05-05 08:22:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 24, 2019):

@Raj2032 Not sure, but maybe with mount or bind-mount.

@rusty-snake commented on GitHub (May 24, 2019): @Raj2032 Not sure, but maybe with mount or bind-mount.

gitea-mirror commented

2026-05-05 08:22:29 -06:00

Author

Owner

@Raj2032 commented on GitHub (May 25, 2019):

@rusty-snake Thanks

@Raj2032 commented on GitHub (May 25, 2019): @rusty-snake Thanks

gitea-mirror commented

2026-05-05 08:22:30 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 28, 2019):

@Raj2032 since it seems like your questions were answered, I'll go ahead and close this. Feel free to re-open if you have more questions!

@chiraag-nataraj commented on GitHub (May 28, 2019): @Raj2032 since it seems like your questions were answered, I'll go ahead and close this. Feel free to re-open if you have more questions!

gitea-mirror referenced this issue

2026-05-05 10:12:53 -06:00

[PR #1713] [MERGED] Apparmor: fix broken file dialogs in kde plasma #4052

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1713

No description provided.

Rows
Columns