Bubblejail is a bubblewrap-based alternative to Firejail.
Bubblejail's design is based on observations of Firejail's faults.
One of the biggest issues with Firejail is that you can accidentally run unsandboxed applications and not notice.
Bubblejail, instead of trying to transparently overlay an existing home directory, creates a separate home directory.
Every Instance represents a separate home directory. Typically, every sandboxed application has its own home directory.
Each instance has a services.toml
file which defines the configuration of the instance such as system resources that the sandbox should have access to.
Service represents some system resources that the sandbox can be given access to. For example, the Pulse Audio service gives access to the Pulse Audio socket so that the application can use sound.
Profile is a predefined set of services that a particular application uses. Using profiles is entirely optional.
AUR is preferred way of installing
If you are not using Arch Linux you can try to manually install with meson
- Python 3 (>= 3.9) - python interpreter
- Python XDG - XDG standards for python
- Python TOML - TOML file support for python
- Bubblewrap (>= 0.5.0) - sandboxing command line utility
- XDG D-Bus Proxy - filtering dbus proxy
- Desktop File Utils - to manipulate default applications
- Python Qt5 - for GUI
- Meson - build system
- m4 - macro generator used during build
- x86_64 architecture (please open an issue if you are interested in other architectures)
Optional:
- bash-completion - auto-completions for bash shell
- fish - auto-completions for fish shell
- Run
meson setup build
to setup build directory - Switch to build directory
cd build
- Compile
meson compile
- Install
sudo meson install
If you want to uninstall run ninja uninstall
from build directory.
Configuration utility
- Install bubblejail from AUR git or AUR stable
- Install the application you want to sandbox (for example, firefox)
- Run GUI. (should be found under name
Bubblejail Configuration
) - Press 'Create instance' button at the bottom.
- Select a profile. (for example, firefox)
- Optionally change name
- Press 'Create'
- The new instance is created along with new desktop entry.
See man page:
bubblejail create --profile firefox FirefoxInstance
bubblejail run FirefoxInstance
bubblejail create --no-desktop-entry --profile generic Test
- common: settings that are not categorized
- x11: X windowing system. Also includes Xwayland.
- wayland: Pure wayland windowing system.
- network: Access to network.
- pulse_audio: Pulse Audio audio system.
- home_share: Shared folder relative to home.
- home_paths: List of path strings to share with sandbox. Required.
- direct_rendering: Access to GPU.
- enable_aco: Boolean to enable high performance Vulkan compiler for AMD GPUs.
- systray: Access to the desktop tray bar.
- joystick: Access to joysticks and gamepads.
- root_share: Share access relative to /.
- paths: List of path strings to share with sandbox. Required.
- openjdk: Access to Java libraries.
- notify: Access to desktop notifications.
- firefox
- firefox_wayland: Firefox on wayland
- code_oss: open source build of vscode
- steam
- lutris
- chromium
- transmission-gtk
- generic: most common services, useful for sandboxing applications without profiles