Firejail blocks access to conda #1

Activity

1. githubnemo commented on Oct 24, 2025

   

   githubnemo

   on Oct 24, 2025

   Last edited by githubnemo

   Owner

   More actions

   Yes, I'm not using conda as much, so this is a bit untested. I've tried adding rudimentary support for it but I expect to run into trouble in some places.

   Once you create a python sandbox using create-python-sandbox and enter it using firejail --profile=python-env-<sandbox_name> --tab bash this shell will have CONDA_ENVS_PATH set to ~/envs/<sandbox_name>/conda. (The prefix ~/envs/ can be overridden by setting PYSANDBOX_ENVS_PATH before calling create-python-sandbox).

   This is crucial, you have to have your conda envs in the $CONDA_ENVS_PATH - this directory is whitelisted and persistent. Having the environments separate from the conda installation is a good thing since you would not want to update the base installation from inside a sandbox which might be hijacked.

   I decided not to force a default installation dir whitelist for anaconda. For this there exists the option of a user override via python-env-template.local in ~/.config/firejail/.

   For example an excerpt of my ~/.config/firejail/python-env-template.local which is included in every sandbox profile:

   # Enable read-only access to (mini)forge/conda directory
   whitelist ${HOME}/Code/conda
   read-only ${HOME}/Code/conda
   whitelist ${HOME}/bin/conda
   whitelist ${HOME}/bin/mamba
   

   You can do something similar to allow read only(!) access to the conda installation dir.