How to: Run applications in a sandbox with FireJail
#### Why

It's absolutely better, for many applications, to run in a sandbox.

Browsers (even more the Closed Source ones) and eMail Clients are highly suggested.

#### Goals

- confine applications in a jail (few safe directories) and block access to the rest of the system

#### References

- Thanks to [FireJail](https://firejail.wordpress.com/)

#### Steps

1. Install the software:

    ``` bash
    sudo apt install firejail firejail-profiles
    ```
    
    Note: for Debian 10 Stable, official Backport is suggested:

    ``` bash
    sudo apt install -t buster-backports firejail firejail-profiles
    ```

2. Allow an application (installed in `/usr/bin` or `/bin`) to run only in a sandbox (see few examples below here):

    ``` bash
    sudo ln -s /usr/bin/firejail /usr/local/bin/google-chrome-stable
    sudo ln -s /usr/bin/firejail /usr/local/bin/firefox
    sudo ln -s /usr/bin/firejail /usr/local/bin/chromium
    sudo ln -s /usr/bin/firejail /usr/local/bin/evolution
    sudo ln -s /usr/bin/firejail /usr/local/bin/thunderbird
    ```

3. Run the application as usual (via terminal or launcher) and check if it's running in a jail:

    ``` bash
    firejail --list
    ```

4. Allow a sandboxed app to run again as it was before (example: firefox)

    ``` bash
    sudo rm /usr/local/bin/firefox
    ```

([Table of Contents](#table-of-contents))