###############################################################################
# COMPREHENSIVE FIREJAIL CLI CHEAT SHEET #
###############################################################################
# 1. NETWORK CONTROL & BANDWIDTH SHAPING
# -----------------------------------------------------------------------------
firejail --net=none name-of-app # Run app with NO internet access
firejail --net=lo name-of-app # Run app with local loopback interface only
firejail --dns=1.1.1.1 name-of-app # Force app to use a specific DNS server
firejail --net=eth0 --bandwidth=eth0:down:1mbps # Shape network; cap download speed at 1mbps
# 2. FILE SYSTEM ISOLATION (EPHEMERAL VS. PERSISTENT)
# -----------------------------------------------------------------------------
firejail --private name-of-app # Ephemeral: Blank home directory (wiped on close)
firejail --private=/home/user/isolated_folder/ \
name-of-app # Persistent: Lock app data into a specific real folder
firejail --read-only=~/Documents name-of-app # Mount a target directory as read-only
firejail --blacklist=~/.ssh name-of-app # Hide a sensitive folder completely from the app
firejail --whitelist=~/Downloads name-of-app # Restrictive: ONLY allow access to Downloads, hide rest of home
# 3. DISPLAY & HARDWARE GRAPHICS SECURITY
# -----------------------------------------------------------------------------
firejail --nodisplay name-of-app # Completely block access to X11/Wayland display servers
firejail --x11=xpra name-of-app # Sandbox X11: Prevent app from keylogging other open windows
firejail --nortcwd name-of-app # Mask the real current working directory from the app
firejail --nou2f name-of-app # Disable access to U2F/Yubikey security keys
# 4. RESOURCE LIMITS & PERFORMANCE (CGROUPS)
# -----------------------------------------------------------------------------
firejail --cpu=0,1 name-of-app # CPU Pinning: Force app to run ONLY on CPU cores 0 and 1
firejail --rlimit-as=1g name-of-app # RAM Cap: Kill the process if it uses more than 1GB of memory
firejail --nice=10 name-of-app # Lower process priority so it doesn't slow down your PC
# 5. ADVANCED SYSTEM LOCKDOWNS
# -----------------------------------------------------------------------------
firejail --noroot name-of-app # Strip app of any ability to gain root/sudo privileges
firejail --seccomp name-of-app # Block dangerous, non-standard Linux system calls
firejail --caps.drop=all name-of-app # Drop all Linux kernel capabilities for the process
firejail --net=none --private --noroot app-name # Hardcore "prison" combo (No net, no home, no root)
# 6. MONITORING & MANAGING ACTIVE SANDBOXES
# -----------------------------------------------------------------------------
firejail --list # List all running sandboxes and their PIDs
firejail --tree # View a live process tree inside active sandboxes
firejail --netstats # View real-time bandwidth/network stats
firejail --shutdown=12345 # Forcefully kill a sandbox by its PID
# 7. INTEGRATION & PERMANENT CONFIGURATIONS
# -----------------------------------------------------------------------------
sudo firecfg # Automatically route desktop shortcuts through firejail
sudo firecfg --clean # Undo all permanent desktop firejail symlinks