I have this local network service and this client program needing to access it. I am running them both as an unprivileged user.

I am looking for a way to sandbox the client using firejail, in a way that it cannot access network, except for localhost (or even better, except for that service). first thing I tried was of course

firejail --net=lo program

But it didn’t work.

Error: cannot attach to lo device

I think I could work around it by creating a virtual network interface, for example veth0 and veth1, moving veth1 to a new network namespace in which I’d run the service and using firejail to restrain the client to veth0

Is there a way to actually automate this setting in a firejail profile, so that all of these interfaces are created and veth1 is moved when I type

firejail server

(without having to run anything as root)?

Or is there a simpler way solve this problem? (I cannot run both the client and the service in the same namespace, because the service needs to access the network)


I would use and option kind of like:

firejail --interface=eth0.vlan100 --ip=someipaddress someprogram

Support for ipvlan driver was introduced in Linux kernel 3.19.

Found Here: man firejail | Firejail

| improve this answer | |
  • That command doesn't work for me, it gives the error "Error: no network device configured" – pdw Dec 6 '18 at 11:13
  • You still have to set up that virtual interface. That command is given as an example, I have no idea what your network interface is it could be eth0 wlan0 or eth1, wlan1 etc.... – Michael Prokopec Dec 6 '18 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.