5 ms·

There isn't a performance decrease. Apps run as an ordinary process but with extra restrictions about what they can access.

• jhardy54 6y ago
  How? Usually that would require a layer of virtualization that checks all syscalls to filter out the naughty ones.
  • eikenberry 6y ago
    They have a sections discussing the technology in their docs. https://firejail.wordpress.com/documentation-2/basic-usage/#tech https://firejail.wordpress.com/documentation-2/basic-usage/#... https://firejail.wordpress.com/documentation-2/seccomp-guide/ https://firejail.wordpress.com/documentation-2/seccomp-guide...
    • yonixw 6y ago
      tl;dr Linux has some kernel features that can be combined to be used as a sandbox. On windows, in contrast, you would have to use a virtualization layer or sys-call interceptor.
  • diegocg 6y ago
    Seccomp does that. No need for a visualisation layer.