4 ms·

Theoretically, so that Firefox doesn't have trivial access to other files available to my user.

xorcist 7y ago
Running it as a different user should suffice. Anyway, the problem alluded to is probably X11. Any GUI application will be able to do things like sniffing your keyboard and clipboard data. It's hard to do right (but of course isn't reason to not run untrusted applications with low privileges) and one of the things Wayland set out to improve.
- aidenn0 7y ago
  You can run it in a separate vnc session as well to get isolation from X11, but that's a PITA.
minimalist 7y ago
Use firejail instead. They use similar features (namespaces, seccomp, etc.)
Scarbutt 7y ago
You can run GUI apps from docker?
- aidenn0 7y ago
  You can run GUI apps across a network, so why not?
  - Scarbutt 7y ago
    ah duh, forgot about how X11 works for a moment.
- sp332 7y ago
  It takes a little configuration to allow X11 access, but yeah. https://github.com/woahbase/alpine-firefox https://github.com/woahbase/alpine-firefox Heck, Qubes OS https://www.qubes-os.org/ https://www.qubes-os.org/ even runs GUI apps from separate Xen VMs.
- inetknght 7y ago
  Yes. See also my other reply to basically the same question: https://news.ycombinator.com/item?id=21998987 https://news.ycombinator.com/item?id=21998987
- Legogris 7y ago
  jessfraz has a great collection of Dockerfiles for various applications: https://github.com/jessfraz/dockerfiles https://github.com/jessfraz/dockerfiles x11docker provides tooling: https://github.com/mviereck/x11docker https://github.com/mviereck/x11docker
yjftsjthsd-h 7y ago
Have you looked at firejail?
- inetknght 7y ago
  I have not. How does it compare, particularly for applications that need X11 to usefully function?
  - yjftsjthsd-h 7y ago
    Way easier to use. For X: https://firejail.wordpress.com/documentation-2/x11-guide/ https://firejail.wordpress.com/documentation-2/x11-guide/ EDIT: also, https://wiki.archlinux.org/index.php/Firejail#Firejail_with_Xephyr https://wiki.archlinux.org/index.php/Firejail#Firejail_with_...

Running it as a different user should suffice. Anyway, the problem alluded to is probably X11. Any GUI application will be able to do things like sniffing your keyboard and clipboard data. It's hard to do right (but of course isn't reason to not run untrusted applications with low privileges) and one of the things Wayland set out to improve.

aidenn0 7y ago
You can run it in a separate vnc session as well to get isolation from X11, but that's a PITA.

minimalist 7y ago

Use firejail instead. They use similar features (namespaces, seccomp, etc.)

Scarbutt 7y ago

You can run GUI apps from docker?

aidenn0 7y ago
You can run GUI apps across a network, so why not?
- Scarbutt 7y ago
  ah duh, forgot about how X11 works for a moment.
sp332 7y ago
It takes a little configuration to allow X11 access, but yeah. https://github.com/woahbase/alpine-firefox https://github.com/woahbase/alpine-firefox Heck, Qubes OS https://www.qubes-os.org/ https://www.qubes-os.org/ even runs GUI apps from separate Xen VMs.
inetknght 7y ago
Yes. See also my other reply to basically the same question: https://news.ycombinator.com/item?id=21998987 https://news.ycombinator.com/item?id=21998987
Legogris 7y ago
jessfraz has a great collection of Dockerfiles for various applications: https://github.com/jessfraz/dockerfiles https://github.com/jessfraz/dockerfiles x11docker provides tooling: https://github.com/mviereck/x11docker https://github.com/mviereck/x11docker

yjftsjthsd-h 7y ago

Have you looked at firejail?

inetknght 7y ago
I have not. How does it compare, particularly for applications that need X11 to usefully function?
- yjftsjthsd-h 7y ago
  Way easier to use. For X: https://firejail.wordpress.com/documentation-2/x11-guide/ https://firejail.wordpress.com/documentation-2/x11-guide/ EDIT: also, https://wiki.archlinux.org/index.php/Firejail#Firejail_with_Xephyr https://wiki.archlinux.org/index.php/Firejail#Firejail_with_...