3 ms·
Use firejail, it's a "one click" solution with prepackaged profiles. https://github.com/netblue30/firejail/ https://github.com/netblue30/firejail/ It uses the
by 5e92cb50239222b 5y ago
Use firejail, it's a "one click" solution with prepackaged profiles.
https://github.com/netblue30/firejail/ https://github.com/netblue30/firejail/
It uses the same kernel knobs as systemd does, but is more user-friendly and has more features.
I use it for every application that handles data received from other machines: books, images, documents, whatever.
- YorickPeterse 5y agoYou can also use Bubblewrap, but getting it up and running requires a lot more fiddling around. For example, this is what I use to isolate Zoom from the rest of my system: https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6fb7629fd9b482353e36798c7bf31a/dotfiles/bin/zoom-jail https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6... In my case I'm using Bubblewrap because Firejail was only used for Zoom, and this felt a bit of a waste considering Bubblewrap was already installed.