[madaidan]

Firejail has far too large attack surface and is suid root which has resulted in plenty of privilege escalation vulnerabilities.

https://seclists.org/oss-sec/2017/q1/25

https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Also see this thread https://github.com/netblue30/firejail/issues/3046

Instead, we're going to use bubblewrap which is similar but with minimal attack surface. See the sandbox-app-launcher section of the post.