Sandboxing Firefox with Firejail: a no-trace browser that can't read my files or reach my LAN

The article discusses a method to create a "no-trace" browser using Firefox and Firejail, which protects users' files and network activities from being accessed or affected by malware or malicious pages. The user wanted to open links from sketchy sources without worrying about malware or data leakage. However, their initial attempts failed due to issues with Firefox profile directories.

The solution involves using a persistent sandbox profile and enabling permanent private browsing in Firefox, using a custom profile and user.js file. This allows the user to keep their extensions, themes, and logins while ensuring that their browsing activity is private and cannot persist after a session.

To make the system work, three key artifacts are created:

1. A whitelist configuration file (firefox.local) that specifies only the sandbox profile directory.

2. A user.js file that sets up permanent private browsing and anti-fingerprinting preferences.

3. An fsand script that launches Firefox with the specified profile and settings.

Additionally, the article covers network hardening by configuring Firejail to create its own virtual network interface and configuring iptables rules to block access to the LAN. This ensures that the sandboxed browser cannot reach the user's local network, even if the host system's firewall rules are not sufficient.

Overall, the method provides a secure and isolated browsing environment that preserves user privacy and protects their system from potential threats.