{"id":153282,"date":"2026-01-04T11:12:36","date_gmt":"2026-01-04T09:12:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-sistemy-izolyaczii-prilozhenij-firejail-0-9-78"},"modified":"2026-01-04T11:12:36","modified_gmt":"2026-01-04T09:12:36","slug":"reliz-sistemy-izolyaczii-prilozhenij-firejail-0-9-78","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-sistemy-izolyaczii-prilozhenij-firejail-0-9-78","title":{"rendered":"Release of the application isolation system Firejail 0.9.78","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of Firejail 0.9.78 has been published, which develops a system for the isolated execution of graphical, console, and server applications, allowing for the minimization of the risk of compromising the main system when running untrusted or potentially vulnerable programs. The program is written in C, distributed under the GPLv2 license, and can run on any Linux distribution with a kernel version above 3.0. Ready-made Firejail packages are available in deb (Debian, Ubuntu) and rpm (CentOS, Fedora) formats. <\/p>\n
Firejail uses namespaces, AppArmor, and syscall filtering (seccomp-bpf) in Linux for isolation. After launch, the program and all its child processes use separate views of kernel resources, such as the network stack, process table, and mount points. Interdependent applications can be combined into a single shared sandbox. If desired, Firejail can also be used to run Docker, LXC, and OpenVZ containers. <\/p>\n
Unlike container isolation tools, firejail is extremely simple to configure and does not require a pre-built system image \u2014 the container's composition is formed on the fly based on the current file system content and removed after the application finishes running. Flexible access rule mechanisms for the file system are provided, allowing you to define which files and directories have access permissions or are denied access, attach temporary file systems (tmpfs) for data, restrict file or directory access to read-only, and combine directories using bind-mount and overlayfs. <\/p>\n
Pre-prepared isolation profiles for system calls are available for a large number of popular applications, including Firefox, Chromium, VLC, and Transmission. To obtain the necessary privileges for setting up an isolated environment, the firejail executable is installed with the SUID root flag (privileges are dropped after initialization). To run a program in isolation mode, simply specify the application's name as an argument to the firejail utility, for example, 'firejail firefox' or 'sudo firejail \/etc\/init.d\/nginx start'. <\/p>\n
In the new release: <\/p>\n
\n
The firejail.config configuration file has been updated with arg-max-count, arg-max-len, env-max-count, and env-max-len options to modify the limits on the number and size of command line options and environment variables. By default, the number of arguments is limited to 128, the number of environment variables to 256, and the size of each argument is PATH_MAX from limits.h (in Linux, 40196) + 32.\n
An option '--xephyr-extra-params' has been added to specify additional options for Xephyr (used to create sandbox environments for X11 with its own X server running in a window) in the command line without modifying firejail.config.\n
The utility bwrap (bubblewrap) installed in the sandbox environment has been replaced by the fbwrap layer, which launches programs without isolation to solve startup issues for Firefox, Thunderbird, and GIMP due to the glycin 2.0.0 call from gdk-pixbuf2 using bwrap. An option '--allow-bwrap' has been added for copying bwrap instead of the layer.\n
The syscall tables for seccomp have been updated. New system calls, such as epoll_pwait2 and futex_wait, have been added.\n
The build option '--disable-globalcfg' has been removed, support for overlayfs ('--overlay') has been discontinued, and the IDS (Intrusion Detection System, '--ids') mode is no longer supported.\n
Isolation profiles have been added for the text editor ne, the Trivalent browser, and the game engines OpenRA, quakespasm, gzdoom, lzdoom, uzdoom.\n
Profiles have been updated for Thunderbird, Wine, Qutebrowser, Firefox, Godot, Wusc, Mullvad-browser, Blink, Steam, SSH, Brave, and Hashcat. <\/ul>\n