Posted July 29, 2019
![avatar](http://images.gog.com/224eb99b3ba5d36a3b7c4841755afe09060ee37c247b7848fa439892f08bd362_avm.jpg)
Firejail is a separate project.
firejail always launches in a separate PID namespace, meaning the process does not have access to any other processes you have running.
using the parameter "--net=none" the process will use a separate network namespace, where no network interface is configured. ie. forbidding network access to anything.
using "--private=${HOME}/games/xxxx" will mount the given directory ontop of your home directory, so the process can't read or write anything to your ${HOME}. Instead it treats "${HOME}/games/xxxx" as its home directory.
is that the sort of locking down that you are looking for ?