Sandbox

A script for sandboxing desktop apps using bwrap.

Examples

A shell with access to the current directory but nothing else:

sandbox

ssh with access to the internet and the current directory:

INTERNET=y sandbox ssh user@example

vlc with untrusted access to the X server (quite slow):

X11=y AUDIO=y sandbox vlc

vlc with full access to the X server:

X11=y X11_TRUSTED=y X11_DRI=y AUDIO=y sandbox vlc

Okular running in weston:

WESTON=y sandbox okular test.pdf

Okular running in Xephyr:

XEPHYR=y sandbox okular test.pdf