# Sandboxing Firefox using firejail (portals, d-bus, pipewire, pulseaudio, webcam, ...)
**URL:** https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852
**Category:** Help
**Created:** [May 26, 2026, 7:26pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852 "2026-05-26T19:26:02Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@BoredSquirrel](https://discourse.nixos.org/u/BoredSquirrel)
#### Post date: [May 26, 2026, 7:26pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/1 "2026-05-26T19:26:02Z")
Flatpak is nice, but it consumes way too much storage space and is currently not suitable for browsers at all, as they block user namespace creation and workarounds like zypak should still be considered experimental.
When sandboxing, the browser should be first priority, as it runs executable code with **every site you visit**. Yes, SVG rendering, PDF viewers etc. are cool, but browsers should be the focus.
As NixOS does not have packages for [bubblejail](https://github.com/igo95862/bubblejail) or [crabjail](https://codeberg.org/crabjail/crabjail) yet, and has some support for firejail, I wanted to give that a try.
I want to document what I found, and ask for help closing the many gaps I found.
## Findings
I found a bunch of different ways to declare the same thing. Example:
```nix
programs.firejail = {
enable = true;
wrappedBinaries.firefox = {
executable = "${lib.getBin pkgs.firefox}/bin/firefox";
profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
extraArgs = [
"--dbus-user.talk=org.freedesktop.Notifications"
];
};
environment.etc = {
# DEFAULTS
"firejail/firejail.config".text = ''
dbus-user.talk org.freedesktop.Notifications
''
# FIREFOX
"firejail/firefox.local".text = ''
dbus-user.talk org.freedesktop.Notifications
'';
};
```
I decided to go with the latter, building a config for shared permissions (`/etc/firejail/firejail.config`) , and one for local overrides (`/etc/firejail/firefox.local`), as they are cleaner and don’t cause huge process commands.
There are default profiles, but I was not able to find a repo where they are stored. They can be accessed locally like so
```sh
cp /nix/store/ric45krl3nij5437n8brqx8nayyzimkh-firejail-0.9.80/etc/firejail/firefox.profile .
```
## Things that don’t work
In Firefox, the filechooser portal works. But the “select application to open file” menu does not work at all, which should be handled by the system. I am using, among others, the following configs for all programs
```nix
dbus-user.talk org.a11y.Bus
dbus-user.talk org.freedesktop.portal.*
dbus-user.talk org.freedesktop.UPower
read-only ~/.local/share/applications
# system desktop entries folder missing
```
## Questions
How do I replace variables in the profile text, like the ones from the hardened firejail profiles?
```sh
noexec ${HOME}
noexec /tmp
noexec ${RUNUSER}
```
How do I replace paths, like these?
```conf
whitelist /usr/share/firefox
whitelist /usr/share/mozilla
whitelist /usr/share/fonts
whitelist /usr/share/icons
private-bin firefox,firefox-esr,which,sh,env,bash
private-etc hosts,passwd,mime.types,fonts,mailcap,firefox,xdg,gtk-3.0,X11,pulse,alternatives,localtime,nsswitch.conf,resolv.conf
```
## Future perspective
It seems that firejail is maintained and stable. There were security incidents with it in the past, and I can imagine that other tools might be more secure. But I don’t know that yet.
I can say that firejail works pretty well currently! [this workaround](https://wiki.nixos.org/wiki/Firejail#Add_Desktop_Icons_to_Firejailed_Apps) did not work and was not needed for icons to appear as usual
Links
- [Ongoing work for bubblejail](https://github.com/NixOS/nixpkgs/pull/373790)
---
### Author:  [@bitbloxhub](https://discourse.nixos.org/u/bitbloxhub)
#### Post date: [May 26, 2026, 7:42pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/2 "2026-05-26T19:42:15Z")
Plugging this as a nice way to sandbox things with Bubblewrap on Nix as a Firejail alternative, does not have flatpak `userns` restrictions by default (you can do `disable-userns` but that’s optional) but can use Flatpak manifests and translate them to `bwrap` args, currently using for Spotify and PrismLauncher:
> **[GitHub - Naxdy/nix-bwrapper: A user-friendly method of sandboxing applications...](https://github.com/Naxdy/nix-bwrapper)**
>
> A user-friendly method of sandboxing applications using bubblewrap with portals support.
---
### Author:  [@nosferatu](https://discourse.nixos.org/u/nosferatu)
#### Post date: [May 26, 2026, 10:40pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/3 "2026-05-26T22:40:04Z")
I’ve been meaning to experiment this with steam so winapps can’t run malware on /home
Bookmarking this thread.
---
### Author:  [@BoredSquirrel](https://discourse.nixos.org/u/BoredSquirrel)
#### Post date: [May 27, 2026, 8:22pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/4 "2026-05-27T20:22:35Z")
that is really cool! I need to learn more about flakes for installing it, but it sounds like a great alternative to firejail, and better than hacking bubblejail to somehow work with nix
---
### Author:  [@daanturo](https://discourse.nixos.org/u/daanturo)
#### Post date: [August 12, 2026, 10:30am UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/5 "2026-08-12T10:30:14Z")
Hello, can you share the your URL of getting `org.mozilla.firefox`’s Flatpak manifest file? [https://flathub.org/en/apps/org.mozilla.firefox](https://flathub.org/en/apps/org.mozilla.firefox) leads me to [hg-edge.mozilla.org/mozilla-central](https://hg.mozilla.org/mozilla-central/file/tip/browser/installer/linux/app/flatpak), which doesn’t seem to contain the file.
---
### Author:  [@bitbloxhub](https://discourse.nixos.org/u/bitbloxhub)
#### Post date: [August 12, 2026, 4:31pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/6 "2026-08-12T16:31:47Z")
Unfortunately it’s built by a custom python script before uploading:
>
The good news is that `nix-bwrapper` only needs `id` and `finish-args`, so you can make a JSON file with all the args after `"build-finish", "build"` in `finish-args` and the ID (`org.mozilla.firefox`) as `id`.
---
### Author:  [@Brisingr05](https://discourse.nixos.org/u/Brisingr05)
#### Post date: [August 12, 2026, 4:58pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/7 "2026-08-12T16:58:57Z")
Might me relevent/useful: [What are the differences between nix-bwrapper, nixpak, jail.nix and nixjail and which one should I chose?](https://discourse.nixos.org/t/what-are-the-differences-between-nix-bwrapper-nixpak-jail-nix-and-nixjail-and-which-one-should-i-chose/79202)
---
### Author:  [@bitbloxhub](https://discourse.nixos.org/u/bitbloxhub)
#### Post date: [August 12, 2026, 5:01pm UTC](https://discourse.nixos.org/t/sandboxing-firefox-using-firejail-portals-d-bus-pipewire-pulseaudio-webcam/77852/8 "2026-08-12T17:01:32Z")
Important thing to consider about these with Firefox (and other browsers) is also whether any of them do `--disable-userns` with bwrap, which breaks some browser page sandboxing (unless they have some way to re-enable it).