Posted July 29, 2019
Gekko_Dekko: And if you've meant firejail - iirc it actually uses bubblewrap for sandboxing purposes
i'm pretty sure it does not. Flatpak uses bubblewrap for its sandboxing. Firejail is a separate project.
firejail always launches in a separate PID namespace, meaning the process does not have access to any other processes you have running.
using the parameter "--net=none" the process will use a separate network namespace, where no network interface is configured. ie. forbidding network access to anything.
using "--private=${HOME}/games/xxxx" will mount the given directory ontop of your home directory, so the process can't read or write anything to your ${HOME}. Instead it treats "${HOME}/games/xxxx" as its home directory.
is that the sort of locking down that you are looking for ?