Firejail

Firejail is an easy to use SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities.

Installation

Add following line to your system configuration to install Firejail globally

environment.systemPackages = with pkgs; [ firejail ];