I’m not familiar with firejail, sorry. I guess that firejail (or regular containers with podman) can be ok for CLI tools which only need access to very specific paths, if any. But for graphical applications like games you probably have to grant a lot of access.

Using a separate user is simpler and it’s guaranteed that the software can only write to the home dir of the user (and other temp paths like /tmp that you don’t care). In case of problems, just wipe the home dir and you are good.

Flatpak sandboxing is weak. For truly untrusted software like pirated games I’d definitely go for a different user which in Linux provides a very strong isolation.

I just use a different user with no privileges to run any pirated or suspicious software.

Yes, of course.

Yes

If this is true, this is very fucked up, definitely in the worst 1%. I’m sorry.

1. Point the hostname of your service to the IP of the proxy in the DNS.

2. For the certs you need an internal CA. I use Step CA which has ACME support so the proxy can get certificates easily.

3. Add the root CA certificate to your computer certificate trust store.

4. Profit!!

Try to avoid installing extensions, they have too much privilege in the browser.

Bicho bola in spanish

Don’t forget the Silverbullet users.