I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on linux. I've tried using firejail (block all network access and temporary fake filesystem) with Wine but could not get Excel or Word to work.

5 Answers 5


You can run wine inside of docker containers to isolate it from your host system. docker does not support GUI applications on its own, but it is possible.

Have a look at x11docker to run GUI applications in docker. There is also a description of short setups without x11docker.

There is also a ready-to-use wine image at docker hub: x11docker/lxde-wine

Example: wine on dockered LXDE desktop (needs a nested X server like e.g. Xephyr):

x11docker --desktop --home x11docker/lxde-wine

The image contains PlayOnLinux, too. Run Playonlinux with:

x11docker --home x11docker/lxde-wine playonlinux

(Option --home creates a persistant home folder for wine container to preserve installed wine installations.)

Disclaimer: I am the author of x11docker, sorry for advertising

Setup without x11docker to provide an independent answer. It lacks some x11docker security features, but basically it works and is much better than installing wine on host:

Dockerfile to build a wine+PlayOnLinux image:

FROM debian:stretch
ENV DEBIAN_FRONTEND noninteractive

# contrib for winetricks, stretch-backports for latest wine
RUN echo "deb http://deb.debian.org/debian stretch contrib" >> /etc/apt/sources.list && \
    echo "deb http://deb.debian.org/debian stretch-backports main" >> /etc/apt/sources.list

# Multiarch for wine32, wine, some often needed dependencies:
RUN dpkg --add-architecture i386 && apt-get update && \
    apt-get -t stretch-backports install -y wine

# helpful additions
RUN apt-get install -y fonts-wine winetricks ttf-mscorefonts-installer winbind

# wine gecko and mono
RUN mkdir -p /usr/share/wine/gecko && \
    cd /usr/share/wine/gecko && wget https://dl.winehq.org/wine/wine-gecko/2.47/wine_gecko-2.47-x86.msi && \
    wget https://dl.winehq.org/wine/wine-gecko/2.47/wine_gecko-2.47-x86_64.msi && \
    mkdir -p /usr/share/wine/mono && \
    cd /usr/share/wine/mono  && wget https://dl.winehq.org/wine/wine-mono/4.7.1/wine-mono-4.7.1.msi

# PlayOnLinux
RUN apt-get install -y playonlinux xterm gettext

CMD playonlinux

Command to run PlayOnLinux image:

# folder on host to store settings and installations
mkdir -p ~/winehome
# allow X access for user in container
xhost +SI:localuser:$(id -un)  
docker run --rm \
    --env DISPLAY=$DISPLAY \
    --user=$(id -u):$(id -g) \
    --env USER=$(id -un) \
    --volume /tmp/.X11-unix:/tmp/.X11-unix \
    --volume ~/winehome:/home/$(id -un) \
    --env HOME=/home/$(id -un) \
    --ipc=host \

Personally, I would implement security profile with some MAC for that. If you run Ubuntu, than out of the box you have AppArmor. It has lower entry level comparing to SELinux, so you have less chances for missconfiguration. You can restrict network access and access to filesystem, so that Word will be able to access only documents in dedicated folder.

BTW: from security perspective having Wine in your Linux environment is a bad idea as it makes you vulnerable to some range of Windows malware.

  • Okay, I will take a look at making an AppArmor profile. I just didn't think it would be sufficient enough to defend from Microsoft Malware. Also regarding the Wine vulnerability, I assume this is really only a risk if I choose to run a malicious .exe, Linux does not automatically run an exe using Wine unless specifically asked to open with Wine right?
    – Joe
    Aug 19, 2018 at 15:15
  • That depends on your system configuration. I don't remember them exactly, but I have seen some approaches that allow Windows binaries to be transparently executed with Wine. I think you need to research a bit. First thing you can check is try to execute some Windows binaries you have in your system. Aug 19, 2018 at 15:20
  • Worryingly whilst I had set executables to open in in vim if accidently double clicked, I discovered that I had some software installed called mono-runtime which executed the .exe on double click. Anyone who reads this please make sure you sudo apt --purge remove mono-runtime
    – Joe
    Aug 19, 2018 at 18:39
  • @Joe Mono is something that helps you to get .NET (C#...) programs to run on Linux. If you don't need it, fine, but disabling the doube-click execution doesn't require uninstalling it - change the Mime configuration, done. ... Other than that, if you didn't do it yet, I recommend giving Libreoffice a try.
    – deviantfan
    Aug 19, 2018 at 22:02

You can try Winepak, which is a Wine image of Flatpak.

Flatpak offers full GUI and sandboxing.

You'll have to build it yourself though.


You could run the program in a new user account that you don't use for anything else. Then any programs run under that account can only access stuff that can be accessed by that account.


sandwine is rather young (as of March 2023) and I don't have Excel or Word at hand to test the with sandwine, but it is a Wine sandbox with multiple options for X11 builtin and it may work for you. Please be sure to read the section on its threat model in the main readme.

PS: It would be interesting what issues you faced with firejail.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .