Open ruihildt opened 1 year ago
@ruihildt I can confirm that mullvad-browser-firejail git project does work well. Flatpaks use bubblewrap for sandboxing applications, though most bigger flatpak projects AFAIK dont use full sandboxing because it breaks a lot of functionality, though they could and really should (just takes more effort). If I had to pick firejail or bubblewrap, bubblewrap is the way to go. It's just a lot harder for new users to use but with strace you can figure out what files a program needs access and then bind or ro-bind them inside a sandbox. The only downside AFAIK is that if you want to seccomps you need to build your own with eBPF. But imo its superior to firejail.