Firejail is probably what you want. I'd be wary of considering Docker as a jail - it does some isolation, but I've yet to see any serious effort or analysis of "safely run arbitrary code as root in docker and avoid escape" (the scenario being at least a full compromise of the app, with potentially an elevation to root in the container). Docker is "(shipping) container first" not "(CIA black site) container first".

Firejail isn't perfect - but it's at least designed to be a jail/sandbox.

There's also the possibility to use lxc via lxd - if you're running xorg you can forward x11 over ssh to the container (or vm). However access to xorg is problematic (eg shared clipboard, window/screen access).

Wayland supposedly does "everything x does" - but I don't know how you connect displays via the network.

But in the end (even though you requested "not vm") - I'd probably have a look at qubes os: https://www.qubes-os.org/

Afaik it mitigates the "shared xorg server" via using x-in-x nested servers (eg xephyr).

Also came across this, which appears to be a little better than "just" docker - but I'd probably still go with firejail or qubes os:

https://github.com/mviereck/x11docker/blob/master/README.md

CentOS / RHEL has UID and GID mapping backported from the 4.x Linux kernel which podman supports. You can run as root in the container and still be remapped to a non-root user outside of it. If you want a locked desktop combine that with Guacamole docker images.

Well there’s docker. You’d have to expose X to the container ( http://fabiorehm.com/blog/2014/09/11/running-gui-apps-with-d... )

Or https://www.flatpak.org/

Edit: hmm apparently there’s also https://firejail.wordpress.com/

FireJail would be simpler to setup and gives the same (relative) protection.

as already mentioned, Firejail https://firejail.wordpress.com/ is easy to use and was made at first to run Firefox in a sandbox. It has pretty neat options and can isolate the FS, make use of a temporary home etc.

LXC and LXD are system containers, which are similar to VMs but using Linux container facilities.

There is an entry-level guide at https://blog.simos.info/how-to-easily-run-graphics-accelerat... that describes how to setup a LXD container so that the GUI applications in the container appear on the host. Here, the GUI applications in the container are using the same X11 server as the host, therefore there is no effort for security isolation.

It is possible for those that are interested, to use features from `x11docker` (second X server, xpra, Xephyr) to provide security isolation with LXD containers.

For the Firefox use-case that you describe, you can setup Firefox and then take a snapshot of the container (`lxc snapshot ...`). Every time that you want to run Firefox, you can switch the container back to the snapshot state and start Firefox.

See BubbleWrap, FireJail, as well as the pre-packaged platforms such as FlatPak / AppImage which run in a container.

For sandboxing in general? There's seccomp, which uses BPF to control what processes are allowed to do.

Is it as easy to use and as polished as Sandboxie? Or is it more low-level?

It's designed to be granular and programmable, so it's probably too low-level if you're looking for something like Sandboxie. I wonder if someone has published a set of rules that "just work", though…

Bubblewrap (https://github.com/containers/bubblewrap) on Wayland. You might have to make a chroot sort of environment for it for it to be convenient enough to use in practice unless you’re okay with exposing the (read-only) contents of /usr, for example, to the sandbox.

SELinux's sandbox[1] tool works pretty well for isolating GUI applications (with -X). [1] https://linux.die.net/man/8/sandbox

If you don't need a GUI then you can use Docker for basic sandboxing. It isn't a foolproof solution, but it's about as close as you are going to get without full virtualization.

You can put GUI apps in docker too. You just need to give access to X or the wayland socket.

This does mean the app can make x calls though. So it could run a keylogger, for instance

There are tutorials on using LXC containers to run graphical applications on Linux.