[GH-ISSUE #3730] Is it unsafe if I run Firejail with --no-sandbox? #2351

New issue

Closed

opened 2026-05-05 09:02:15 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:02:15 -06:00

Owner

Originally created by @jmtb28 on GitHub (Nov 7, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3730

Example: $ firejail --noprofile --appimage app.AppImage --no-sandbox

Originally created by @jmtb28 on GitHub (Nov 7, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3730 Example: `$ firejail --noprofile --appimage app.AppImage --no-sandbox`

gitea-mirror

2026-05-05 09:02:15 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 09:02:18 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 7, 2020):

You talk about the --no-sandbox of chrom*? AppImages have no sandbox.

Pros on disable internal sandboxes of programs:

You can have tighter firejail options (e.g. disallow chroot (firefox), set nonewprivs (chrom* sometimes))
You are able to use firejail (e.g. evolution or other software with bwrap sandboxes w/o firejail integration)

Cons of disable internal sandboxes of programs:

A program can apply even more tight sandboxs to parts of it (e.g. web-content processes can be run w/o any file-system access while the config system needs write access to the filesystem)

My opinion: never disable internal sandboxes

@rusty-snake commented on GitHub (Nov 7, 2020): You talk about the `--no-sandbox` of chrom*? AppImages have no sandbox. Pros on disable internal sandboxes of programs: - You can have tighter firejail options (e.g. disallow `chroot` (firefox), set `nonewprivs` (chrom* sometimes)) - You are able to use firejail (e.g. evolution or other software with bwrap sandboxes w/o firejail integration) Cons of disable internal sandboxes of programs: - A program can apply even more tight sandboxs to parts of it (e.g. web-content processes can be run w/o any file-system access while the config system needs write access to the filesystem) My opinion: never disable internal sandboxes

gitea-mirror commented

2026-05-05 09:02:19 -06:00

Author

Owner

@jmtb28 commented on GitHub (Nov 7, 2020):

You talk about the --no-sandbox of chrom*? AppImages have no sandbox.

Yes I'm exactly referring to that and I forgot to specify that the AppImage application that I'm using is Electron-based. So my question is based around that type of AppImage application.

@jmtb28 commented on GitHub (Nov 7, 2020): > You talk about the `--no-sandbox` of chrom*? AppImages have no sandbox. Yes I'm exactly referring to that and I forgot to specify that the AppImage application that I'm using is Electron-based. So my question is based around that type of AppImage application.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2351

No description provided.

Rows
Columns