How to run a Flatpak Terminal without internet permission?

2026-06-14 04:47 UTC

I want to run a shell script that might open my browser to a specific website. I don’t want the page to load when this happen. But I cannot switch off my internet access also (as I use the internet to remotely access another system at the same time). So I am planning to isolate the run time environment for the shell script. I an on Arch and I used to use a AUR package called bubblejail to do this. But with the whole AUR security fiasco, I am not trusting any packages from AUR. I can switch to another distro if needed, like Rocky or something. So my requirement is, Internet sandboxing for a terminal and the processes it spawns. Preferably using flatpak commands.

Replies (10)

@mcmodknower@programming.dev 2026-06-14 05:35

You want to find a way to remove the “open other programs” permission from the terminal. Or run it in a VM without internet connection.

Open ##3314408
@RheumatoidArthritis@mander.xyz 2026-06-14 06:21

There is likely a less complicated way to do it but sudo to another user account and then run it with the protection. This way it can’t reach your web browser. Or - I don’t know if your program can do it, but Firejail certainly can - hide browser binaries and xdg-open from it, but I don’t know how effective this will be against your particular script. If you don’t trust something maybe don’t run it on your main OS?

Open ##3314537
@HelloRoot@lemy.lol 2026-06-14 06:22

portmaster can turn off internet for a specific app, but even better it can block specific domains actually just putting the website domain (with local ip or something) into hosts file will be enough

Open ##3314540
@Mordikan@kbin.earth 2026-06-14 06:25

I don't think flatseal isolates child processes, only the flatpak itself. You could use firejail. That is available outside the AUR. As there is no socket available, if testing with a browser it should force the browser to crash. You could also try setting up a network namespace that only binds to loopback in case you want local device network access.

Open ##3314552
@A_norny_mousse@piefed.zip 2026-06-14 06:58

firejail should be able to do this with a carefully crafted command line or config file.

Open ##3314753
@blobjim@hexbear.net 2026-06-14 07:41

You need to figure out what B-Bus API is called to open the URL, and block it using the flatpak run argument –no-talk-name=NAME

Open ##3314955
@dieTasse@feddit.org 2026-06-14 16:08

You have to block the browser from the internet not the terminal.

Open ##3317832
@OneCardboardBox@lemmy.sdf.org 2026-06-15 16:42

You said you don’t want the page to load. Do you even care if the browser opens? What about overriding the default browser application that the terminal tries to use? Maybe there’s some env variable to override the xdg browser default, and you could point it to a script that exits instantly.

Open ##3326679
@Eggymatrix@sh.itjust.works 2026-06-14 20:21

Yet again a reminder that flathub solves a problem most people don't have, and most users het confused with what it does. We have had granular permissions for users on systems for 50 years, and virtual machines for 30 years, yet people keep using the wrong tool for the job just because the wrong tools keep getting popilar for some damn reason. OP you are using your flatpack terminal wrong, the processes it launches do not inherit the constraints, or at least are not forced to follow them. Use a separate user account for that.

Open ##3352243
@OneCardboardBox@lemmy.sdf.org 2026-06-15 16:43

You said you don't want the page to load. Do you even care if the browser opens? What about overriding the default browser application that the terminal tries to use? Maybe there's some env variable to override the xdg browser default, and you could point it to a script that exits instantly.

Open ##3352244