Firejail vs Sandlock

Firejail is a free, self-hosted Linux sandboxing program for restricting untrusted applications, servers, graphical programs, and login sessions. It uses Linux namespaces and seccomp-bpf so sandboxed processes receive private views of network, process, and mount tables. The software runs on Linux computers with a 3.x kernel or newer. Security controls include protocol filtering, noroot user namespaces, Linux capabilities, D-BUS filtering, and optional AppArmor or SELinux support. Mandatory Access Control can block more than 1,000 desktop applications from passwords, encryption keys, and private data, with more than 1,000 profiles available in /etc/firejail. Firejail can create an isolated TCP/IP stack with routing, firewall, and interfaces, and nettrace can inspect traffic. AppImage packages are supported. Firetools adds a Qt5 graphical launcher, tray integration, editing, management, and statistics; FDNS provides DNS-over-HTTPS through non-logging providers. Running sudo firecfg integrates application menus and file-manager launches. The project targets home users and Linux beginners rather than enterprise customers.

Sandlock is a Linux process sandbox for confining untrusted code with policies enforced by the kernel. It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem access, network activity, system calls, and resource use. Policies can deny network egress by default, apply HTTP method, host, and path rules, stage writes through copy-on-write, and set resource limits. A supervisor can attach credentials through a proxy after an HTTP access check, keeping the secret value out of the sandboxed workload. Interfaces include a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server. The OCI runtime works with containerd, CRI-O, and Kubernetes, while the remote MCP API can connect to Claude Desktop, Cursor, or another MCP client. Sandlock runs as an ordinary user without root, a container runtime, or a hypervisor. Linux 6.12 or later supports the full protection set by default; older kernels require explicit waivers for missing protections. It shares the host kernel, excluding kernel vulnerabilities and hardware side channels from its guarantees.