3 ms·

For me the interesting part of Firejail is the interface. bwrap is usually recommended as a replacement given that the binary is smaller and thus offers less at

by nextos 2y ago

For me the interesting part of Firejail is the interface. bwrap is usually recommended as a replacement given that the binary is smaller and thus offers less attack surface, which I think is the usual concern. Firejail employs kernel user_namespaces, but also offers integration with AppArmor.

hollerith 2y ago
>the binary is smaller and thus offers less attack surface, which I think is the usual concern. Another concern is the huge attack surface that is the Linux kernel.
- fpoling 2y ago
  Firejail attempts to mitigate that with secomp filters.