Confine Firefox

gistfile1.txt

#!/bin/sh
#
# Run Mozilla Firefox in a sandbox - The goal is to deny access to most locations while keeping the full user experience  
#  
# - Read/write access only to ~/Downloads, ~/.mozilla (profiles), and /tmp  
# - /tmp in read/write is needed to access X11 and for temporary downloads  
# - The host /dev is mapped into the sandbox so that access to DRI, camera, and sound devices works  
# - --disable-userns is *not* used to allow Firefox to sandbox itself further  
# - /run is needed to access the current session (e.g., for PipeWire audio)  
# - Developed and tested on OpenSUSE; some paths may vary (e.g., /lib64 or /run)  
#
exec bwrap \
        --dev-bind /dev /dev \
        --proc /proc \
        --bind /tmp /tmp \
        --bind ~/.mozilla ~/.mozilla \
        --bind ~/Downloads ~/Downloads \
        --bind ~/.cache/mozilla ~/.cache/mozilla \
        --ro-bind /bin /bin \
        --ro-bind /lib64 /lib64 \
        --ro-bind /sys /sys \
        --ro-bind /etc /etc \
        --ro-bind /usr /usr \
        --ro-bind /run /run \
        --ro-bind ~/.config ~/.config \
        --unshare-all \
        --share-net \
        firefox "$@"