Firejail – security sandbox

Re:Firejail – security sandbox by gwicke on Saturday August 06, 2016 @09:53PM (#12240709)

At Wikimedia, we are using firejail to lock down services. We encountered some bugs in older versions, but those have since been fixed. Overall, it has been working fairly well for us.

[ Parent | on HN ]

Re:Firejail – security sandbox by Scaevolus on Sunday August 07, 2016 @02:02AM (#12241239)

What made you choose Firejail over alternatives like Docker?

[ Parent | on HN ]

Re:Firejail – security sandbox by danieldk on Sunday August 07, 2016 @02:12AM (#12241253)

Or maybe even more appropriate: AppArmor (or SELinux).

[ Parent | on HN ]

Re:Firejail – security sandbox by dingaling on Sunday August 07, 2016 @05:03AM (#12241530)

Firejail can be invoked and configured by normal unprivileged users. Apparmor requires root for creating and installing new profiles.

[ Parent | on HN ]

Re:Firejail – security sandbox by feld on Sunday August 07, 2016 @09:59AM (#12242089)

The new tools are being invented because the old tools suck.

SELinux is terrible from a UX standpoint

[ Parent | on HN ]

Re:Firejail – security sandbox by mynewtb on Sunday August 07, 2016 @05:30PM (#12243761)

Docker is not for secure sandboxing, afaik you can easily escape and get root.

[ Parent | on HN ]