Firejail has far too large attack surface and is suid root which has resulted in plenty of privilege escalation vulnerabilities. https://seclists.org/oss-sec/2

Firejail has far too large attack surface and is suid root which has resulted in plenty of privilege escalation vulnerabilities. https://seclists.org/oss-sec/2017/q1/25 https://seclists.org/oss-sec/2017/q1/25 https://www.cvedetails.com/vulnerability-list.php?vendor_id=16191&product_id=0 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... Also see this thread https://github.com/netblue30/firejail/issues/3046 https://github.com/netblue30/firejail/issues/3046 Instead, we're going to use bubblewrap which is similar but with minimal attack surface. See the sandbox-app-launcher section of the post.