I have a significant number of untrusted binary applications that need to be executed on a *nix box.

I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could easily be used to isolate a single application from being able to harm or access the rest of the system (I only need access to stdin/stdout).

I'd rather not use full-blown virtual machines, as the overhead resulting from running thousands of copies of an OS is considerably larger than I'd like to consider.


2 Answers 2


There is no secure, easy-to-use command line sandbox utility. Popular utilities such as Firejail can often be a cure worse than the disease, and many sandbox bypasses and privilege escalation vulnerabilities have been found (and continue to be found) in it. Sandboxing an application usually requires using mandatory access controls, such as the popular AppArmor or SELinux framework. This will generally involve customized security policies, tailored to the specific application.

I wrote a lot about Linux sandboxing in another answer.

  • Has the situation improved with bubblewrap? I'm quite happy with it. Commented Apr 9, 2020 at 17:07

firejail command line utility depending on apparmor of SeLinux

apt install firejail
firejail --whitelist=~/Chroot bash
  • 4
    Did you even read @forest answer before posting your answer? Cause if you did why did you not expend it with addressing his comments about Firejail specifically...
    – LvB
    Commented Oct 21, 2020 at 22:16
  • To make it fast
    – Tinmarino
    Commented Oct 22, 2020 at 3:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .