Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to use LXC on a desktop system to confine browsers and other pieces of software that have in the past been shown to be prone to certain kinds of exploits. So what I want to achieve is to jail, say Firefox, be still able to view its windows etc and yet be sure it only has read and write access to anything "inside the bubble", but not the host system.

The example lxc-sshd container in LXC suggests something like this should be possible (app-level containers), but I have only seen this for program that require a TTY at most.

Can this work also under KDE, GNOME, Unity ...?

share|improve this question
Not the same technology, but note that there's a SELinux policy in Fedora to contain Firedox in exactly this way. – mattdm Sep 25 '13 at 3:44
up vote 4 down vote accepted

Firejail is a Linux namespaces sandbox program that can jail Firefox or any other GUI software. It should work on any Linux computer.

share|improve this answer

What desktop manager you are running does not matter; all that matters is that you provide the container with access to the Xwindows socket, the XAUTHORITY environment variable, and the file it points to.

share|improve this answer
Could you give the relevant pieces from the configuration which would get me started?! Thanks. – 0xC0000022L Sep 25 '13 at 4:55
If your GUI App (e.g. firefox) can talk to Xwindows via socket, then there's quite a big window for exploiting bugs in X to escape the container to whatever X can access. So the question becomes whether you can put X windows inside a container. – mc0e Nov 21 '14 at 8:09

Not directly. With technologies such as LXC or OpenVZ the applications inside them are essentially there own Linux boxes. So you'll need to do it "remotely" using tools such as X2go or VNC to see their remote desktops, or remotely display applications running inside them using X.

There is this tutorial which discusses how to do this using Debian/Ubuntu, but much of the steps should be translatable to other distros as well. The article is titled: Debian Virtualization: LXC Desktop Virtualization.

share|improve this answer
LXC does not have to be configured for 100% isolation. – psusi Sep 25 '13 at 2:00
@psusi - OK, can you add how to do that to your answer? I'd be curious to see how, not doubting you, just curious 8-) – slm Sep 25 '13 at 2:02
No, since I haven't actually done it. I just know that they added a bunch of features to the kernel for lxc to be able to share mount points between the containers and what gui apps need access to in order to display. – psusi Sep 25 '13 at 2:07
@psusi - can you point me to references so I can read up on it then? – slm Sep 25 '13 at 2:10
@slm From unix.stackexchange.com/questions/92177/… : lwn.net/Articles/524952 will get you started. – Gilles Sep 25 '13 at 4:35

You can isolate pretty much every desktop related software with lxc.

In this document you can find procedures on how to isolate a desktop program inside a container. The main example is google-chrome.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.