Cannot sandbox Foliate

[disposableone]

This is a pretty big problem. I cannot sandbox Foliate on Fedora Linux. I tried using firejail, and firejail has a separate profile for Foliate, and it's not working 100%. I also cannot quite sandbox webkitgtk6.0, which is a dependency of Foliate. And working with bwrap is horrible.

I really don't care how the backend is worked out, but there must be a straightforward way to just sandbox Foliate in its entirety... I cannot use Foliate because of this, even though I really like it. This is very sad.

[johnfactotum]

Yeah, running bubblewrap inside other sandboxes is known to be problematic, I believe.

If it's any consolation, bubblewrap is WebKitGTK's sandbox, and you might also consider using Flatpak, which will also run the app itself in bubblewrap. It might not be exactly what you want, but it'd at least be sandboxed.

If you're paranoid you can also consider using the demo reader from foliate-js in whatever browser that has been sandboxed.

[disposableone]

Yeah, running bubblewrap inside other sandboxes is known to be problematic, I believe.

If it's any consolation, bubblewrap is WebKitGTK's sandbox, and you might also consider using Flatpak, which will also run the app itself in bubblewrap. It might not be exactly what you want, but it'd at least be sandboxed.

I mean, supposedly firejail isolates all namespaces for all children spawned by the parent application (such as webkitgtk), it's just so messy for some reason right now. I think I got it to work with firejail --noprofile but only under root or something. I think people want to basically cut off network in most cases, too. The application should just be amenable to this in an easy way.

[johnfactotum]

You can disable network permission with Flatpak. Ultimately, GNOME's stack simply hasn't been designed to be used with Firejail. It's all designed around Bubblewrap. That's not something that's solvable on the application level. Or at least not without totally rewriting the app using non-GNOME technologies.

[disposableone]

You can disable network permission with Flatpak. Ultimately, GNOME's stack simply hasn't been designed to be used with Firejail. It's all designed around Bubblewrap. That's not something that's solvable on the application level. Or at least not without totally rewriting the app using non-GNOME technologies.

Well, I just installed Foliate with flatpak --user on Fedora F41. It installed fine, but it plain doesn't launch at all (without any restrictions).