Until the community creates and maintains a Debian package for the “experimental software” presented earlier, Firejail remains a flexible and cautious, though not foolproof, solution.
Oct 11, 2026, 06:18 by [email protected]: > On Sun, Oct 11, 2026 at 07:31:12AM +0200, derlyne wrote: > >> sudo apt install firejail firejail-profiles >> firejail --net=none evince ~/Downloads/file.pdf >> (replace evince with the name of your viewer) >> ----------------------Suspicious .pdf :Move the file to a dedicated folder >> first, then use the `--private` option: >> mkdir -p ~/pdf-to-open >> cp ~/Downloads/file.pdf ~/pdf-to-open/ >> firejail --net=none --private=~/pdf-to-open evince ~/pdf-to-open/file.pdf >> >> a bit complicated no ? >> > > That's what scripting is for. Hey, this is Linux! > >> ------------------------------... a virtual machine could be a better option >> ... >> > > They do different things. Firejail is more akin to containers > (separate namespaces, chroot, etc.) but you share the same > kernel. VMs have separate kernels (at first blush, they are > tighter, but OTOH much more complex, thus they bring along their > whole share of vulnerabilities). > > Cheers > -- > t >
