I want some functionality like Sandboxie on Windows.

That is, I want to run a program in a sandbox. The program doesn't detect the sandbox, and can read files from outside the sandbox usually. But when the program attempts to write files, the files are only written in the sandbox, not outside. And then, possibly outside the sandbox, I want some way to see only the files created inside the sandbox.

I read Installing Sandboxie on ubuntu but it doesn't seem to be what I want.

According to http://www.linux-magazine.com/Issues/2015/173/Firejail, Firejail has an overlay feature, but the files are destroyed when the program which creates them ends. Instead, I want to inspect these files.

It seems these overlay things are part of Linux since kernel 3.18, not sure if there is some way to use them to achieve what I want.

I have Lubuntu 16.04.1 with linux kernel 4.4.0-53-generic.


Firejail can be configured to use a "whitelist" of files allowed to be kept, which would allow you to use it without the files you want to keep being deleted. If you simply want to see what files would be written you can also read the logs.


          Set  directory  or  file  read-write.  Only files or directories
          belonging to the current user are allowed  for  this  operation.

          $ mkdir ~/test
          $ touch ~/test/a
          $ firejail --read-only=~/test --read-write=~/test/a

Running apps within Docker will be a much complicated situation and won't work unless they are command-line applications since there is no graphic server sharing without additional configurations. Also docker is more designed to help these individual containers talk to each other, something you haven't said you needed (and likely don't need in this sandboxing model)

| improve this answer | |
  • So I would need something like sudo firejail myprogram --read-write=/? (I guess / belongs to root). Where are these files stored? – Oriol Dec 11 '16 at 23:16
  • 1
    Don't run firejail (or any other programs) as root unless you have a reason to. You should run firejail as a regular user without sudo. For --read-write you will probably want to create a directory in your home directory and point it to that then run that program inside there, like this: mkdir ~/mywork; cd ~/mywork; firejail --read-write=~/mywork myprogram; Also take note that the way you passed your arguments they would have been given to myprogram and not firejail, the order matters since arguments can also be passed to myprogram. – Kristopher Ives Dec 11 '16 at 23:21
  • I use firejail --overlay and then the programs I run in the console write the files to ~/.firejail/<num>/odiff/. Seems exactly what I want. – Oriol Dec 11 '16 at 23:34

You could use docker containers for this. Docker containers are name-branded old LXC containers that were called BSD jails long ago. Use docker containers and their volume mounting feature so that you can inspect data afterwards and save it.

| improve this answer | |
  • How can I use docker containers? By installing docker.com? – Oriol Dec 11 '16 at 22:52
  • Should be able to install docker by doing 'sudo apt-get install docker'. Then look at all the commands you can do with 'docker help'. I've been working with them extensively recently. – Kyle H Dec 11 '16 at 22:53
  • I tried but seems too hard. Do you know any program with a nice GUI which does this for me? – Oriol Dec 11 '16 at 23:10
  • Docker requires a PPA as they are constantly releasing new versions which break the previous version. Any version you find in the standard repos will be very old by docker standards. – Kristopher Ives Dec 11 '16 at 23:13
  • It would still work for his purposes. I disagree that each version breaks the old. – Kyle H Dec 12 '16 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.