netblue30 is the developer of Firejail, a Linux sandbox, and writes about sandboxing, Debian setups, and lightweight desktops.
HN commenters recommend its Firejail posts as a way to sandbox browsers and desktop apps using namespaces and seccomp, instead of heavier container tools.
The new Firejail app [1] may be worth exploring as it is designed to run locally installed apps like browsers and games in sandboxes, as opposed to more chroot oriented container managers like LXC, Docker or Nspawn. They all use namespaces.
If you want to use a chroot oriented container manager its better to use an unprivileged container so you are not running as root. Currently only LXC has support for unprivileged containers. We have an experimental GUI app container with Chrome that can be used in unprivileged mode. [2]
You can even run your own sandbox with a simple command like this 'unshare -fp --mount-proc' That gives you a bash shell in its own pid space. You can expand this command further to use more namespaces like mount, net, user to get yourself a sandbox.
That is what apps like firejail and container managers are using, but its useful to know what's happening underneath. We are currently working on a guide on how to use unshare that may help. [3]
[1] https://l3net.wordpress.com/projects/firejail/
[2] https://www.flockport.com/apps/lxc-gui/
[3] https://www.flockport.com/how-linux-containers-work/
Updating software shouldn't give a sense of security, instead use sandbox/cipher technologies more generalized, for firefox you could use firejail[0] or sandfox[1].
Or even more general approaches like subuser[2] or QubeOs[3].
Personally I use FF 28.x + Noscript + Adblock plus + Firejail 0.9.28-1 and I feel quite confident I won't get hacked by random attacks.
[0] https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/
[1] https://igurublog.wordpress.com/downloads/script-sandfox/
[2] http://subuser.org/
[3] https://www.qubes-os.org/
Thanks for the feedback and alternatives, I hadn't seen Spoon or LXD yet so I'll check those out. Namespaces are sometimes supported directly by the application itself, for example uWSGI, and anything lacking native support you can use firejail [1]. There is also an article [2] by an OVH employee about using namespaces directly in C.
[1]: https://l3net.wordpress.com/projects/firejail/
[2]: https://blog.jtlebi.fr/2013/12/22/introduction-to-linux-namespaces-part-1-uts/
> Lastly, lightweight containers are the real-deal for small development tasks (not for production!). Just one command: systemd-nspawn, and you're ready to go.
You might be interested in firejail [1]. It makes finer-grained use of Linux namespaces, and doesn't depend on systemd (or much of anything, for that matter).
[1] http://l3net.wordpress.com/projects/firejail/
we can get better compartmentalization than that with things like user namespaces (firejail[1]) or spawning a temporary user id[2]
[1] https://l3net.wordpress.com/projects/firejail/
[2] https://github.com/teran-mckinney/raru
https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/
https://l3net.wordpress.com/2015/02/19/firejail-a-security-sandbox-for-mozilla-firefox-part-2/