Vector does not work with firejail and proxychains security isolation #24

Activity

1. JSKitty commented on Oct 8, 2025

   

   JSKitty

   on Oct 8, 2025

   Last edited by JSKitty

   More actions

   gm @nnmfnwl and thanks for your report!

   The directories Vector requires and use out-the-box are:
   ~/Downloads/vector/* (where all your downloaded media is stored).
   ~/.local/share/vector/* or ~/.local/share/io.vectorapp/* (Vector config and DB stores).

   There may also be WebView cache stored in your cache directory, but I'm not sure where exactly this is stored by webkitgtk specifically.

   Worthy note: Vector should run on Debian fairly well, though playable media may not be functional yet due to WebKit limitations on Linux.

   If you hit any snags, let me know, the experience on Linux is not the greatest right now. 🙏
2. nnmfnwl commented on Oct 8, 2025

   

   nnmfnwl

   on Oct 8, 2025

   Author

   More actions

   gm @nnmfnwl and thanks for your report!

   Thanks for you reply

   The directories Vector requires and use out-the-box are: ~/Downloads/vector/* (where all your downloaded media is stored). ~/.local/share/vector/* or ~/.local/share/io.vectorapp/* (Vector config and DB stores).

   Thanks!

   There may also be WebView cache stored in your cache directory, but I'm not sure where exactly this is stored by webkitgtk specifically.

   The firejail makes home directory isolated, so it seen from app perspective as empty

   Worthy note: Vector should run on Debian fairly well, though playable media may not be functional yet due to WebKit limitations on Linux.
   If you hit any snags, let me know, the experience on Linux is not the greatest right now. 🙏

   Did someone give it try to test it on latest Debian stable?
3. JSKitty commented on Oct 8, 2025

   

   JSKitty

   on Oct 8, 2025

   More actions

   I've only tested and very lightly developed it on Arch myself (and someone else I know has used it on Arch, as well), everything aside from playable media is nicely smooth, I have little feedback from Debian users yet, but curious to know how it goes!
4. nnmfnwl commented on Oct 9, 2025

   

   nnmfnwl

   on Oct 9, 2025

   Last edited by nnmfnwl

   Author

   More actions

   I've only tested and very lightly developed it on Arch myself (and someone else I know has used it on Arch, as well), everything aside from playable media is nicely smooth, I have little feedback from Debian users yet, but curious to know how it goes!

   At least you could install firejail (https://wiki.archlinux.org/title/Firejail) and proxychains (https://archlinux.org/packages/extra/x86_64/proxychains-ng/)

   And try to run Vector bin or Appimage on your system to confirm if issue could be app isolation or operating system itself, by the way Debian stable version been updated "few" days ago.:

    cd ~/Downloads/vector/ && proxychains firejail --whitelist=`pwd` --read-only=`pwd` --whitelist=/home/${USER}/.config/vector/ --whitelist=~/.proxychains --appimage Vector_0.2.0_amd64.AppImage --no-zygote --no-sandbox --disable-gpu
   

   or

    cd ~/Downloads/vector/ && proxychains firejail --whitelist=`pwd` --read-only=`pwd` --whitelist=/home/${USER}/.config/vector/ --whitelist=~/.proxychains ./Vector
   

   or without tor support

   cd ~/Downloads/vector/ && firejail --whitelist=`pwd` --read-only=`pwd` --whitelist=/home/${USER}/.config/vector/ ./Vector
   
5. JSKitty commented on Jan 20, 2026

   

   JSKitty

   on Jan 20, 2026

   More actions

   With lots of experimenting on an Ubuntu 25.10 VM, I've created a guide for running Vector under Firejail + Proxychains, with the most hardened configuration I could put together with Claude, you're welcome to give it a review and also a test drive @nnmfnwl! 🙏

   This config seems solid as of Vector v0.3.0 pre-release, so should remain stable for the Vector v0.3.0 release at the end of the month.

   https://github.com/VectorPrivacy/Vector/blob/master/docs/security/firejail-proxychains.md

   👍React with 👍2Reacted by no en am fro no wer lnd and Yuurin Bee
6. github-actions commented on Jan 20, 2026

   

   github-actionsBot

   on Jan 20, 2026 – with GitHub Actions

   Last edited by github-actions

   More actions

   Claude finished @JSKitty's task in 41s —— View job

   ---

   Firejail & Proxychains Guide Review

   • Read and analyze the security guide document
   • Review for security best practices
   • Check for potential issues or improvements
   • Provide detailed feedback

   ---

   This is a well-written and comprehensive security guide. The documentation is clear, well-structured, and provides practical guidance for users wanting to run Vector in a hardened environment.

   Strengths

   1. Clear organization - The guide follows a logical flow from prerequisites through configuration to troubleshooting
   2. Multi-distro support - Installation commands for Debian/Ubuntu, Arch, and Fedora
   3. Practical troubleshooting section - Addresses the original issue ("Illegal instruction" crash) directly
   4. Defense in depth - The vector.profile includes extensive blacklisting of sensitive directories (SSH keys, GPG, browser data, cloud credentials, etc.)

   Security Profile Review (vector.profile)

   The profile applies strong hardening:

   • caps.drop all - Drops all Linux capabilities
   • seccomp + seccomp.block-secondary - Syscall filtering with architecture restriction
   • noroot, nonewprivs, nogroups - Privilege restrictions
   • private-tmp - Isolated temp directory
   • dbus-system none - No system D-Bus access
   • Explicit blacklisting of sensitive paths (~/.ssh, ~/.gnupg, ~/.aws, etc.)

   Suggestions for Consideration

   1. Minor inconsistency in profile examples

   The profile embedded in the markdown (lines 67-108) differs from vector.profile:

   • Missing the extensive blacklist section
   • Missing seccomp.block-secondary, nogroups, private-tmp
   • Missing machine-id and hostname hardening

   Consider either keeping them in sync or removing the inline version and only referencing the file.

   2. Desktop launcher enhancement

   At line 211, the launcher uses %h which is correct, but you might add a variant for proxychains users:

   # For Firejail + Proxychains
   Exec=firejail --profile=%h/.config/firejail/vector.profile proxychains4 /path/to/vector

   3. Tor browser bundle consideration

   For users who want maximum anonymity, you could mention that Tor service from package managers has a different threat model than Tor Browser Bundle, and link to relevant documentation.

   4. File download path creation

   The troubleshooting section (lines 269-273) references mkdir and whitelist directives, but these aren't in the main profile. Users might need to manually create ~/Downloads/vector/ before first run.

   5. DNS leak testing

   You could add a command to verify DNS isn't leaking:

   proxychains4 dig +short txt whoami.akamai.net

   Overall Assessment

   This is a solid guide that directly addresses the original issue reported by @nnmfnwl. The bare build recommendation is the correct solution for the "Illegal instruction" crash caused by SIMD/AVX instructions in whisper-rs conflicting with seccomp filters.

   The security configuration strikes a reasonable balance between hardening and usability for a WebKitGTK-based application.

   ---

   👍React with 👍1Reacted by no en am fro no wer lnd
7. nnmfnwl commented on Jan 22, 2026

   

   nnmfnwl

   on Jan 22, 2026

   Author

   More actions

   With lots of experimenting on an Ubuntu 25.10 VM, I've created a guide for running Vector under Firejail + Proxychains, with the most hardened configuration I could put together with Claude, you're welcome to give it a review and also a test drive @nnmfnwl! 🙏

   This config seems solid as of Vector v0.3.0 pre-release, so should remain stable for the Vector v0.3.0 release at the end of the month.

   https://github.com/VectorPrivacy/Vector/blob/master/docs/security/firejail-proxychains.md

   Good job.

   file: https://github.com/VectorPrivacy/Vector/blob/master/docs/security/firejail-proxychains.md?plain=1#L78

   noblacklist ${HOME}/.local/share/io.vectorapp
   noblacklist ${HOME}/.local/share/vector
   noblacklist ${HOME}/Downloads/vector
   

   Above configuration lines are just making to not blacklist the directory itself. In general it has no isolation effect as app still has access to all user ${HOME} files, so I would recommend changes. Mark whole HOME directory as not accessible and allow only those paths which are needed, because app should not have access to other user space files. Also app should not have access to rewrite own binary files even if we call it "update" because if internal security vulnerability which could be used in vector or proxychains is found.

   ### access home proxychains config but give no permissions to write in or change files.
   # make dir if not exist
   mkdir ${HOME}/.proxychains
   # do not mark as blacklisted even if inheritance from other files
   noblacklist ${HOME}/.proxychains
   # whitelisting any home directory/file making firejail automatically blacklist all other directories
   whitelist ${HOME}/.proxychains
   # app should have no permissions to update proxychains itself because this could be used if security vulnerability inside app or proxychains itself
   read-only ${HOME}/.proxychains
   
   mkdir ${HOME}/.local/share/io.vectorapp
   noblacklist ${HOME}/.local/share/io.vectorapp
   whitelist  ${HOME}/.local/share/io.vectorapp
   
   mkdir ${HOME}/.local/share/vector
   noblacklist ${HOME}/.local/share/vector
   whitelist ${HOME}/.local/share/vector
   
   mkdir ${HOME}/Downloads/vector
   noblacklist ${HOME}/Downloads/vector
   whitelist ${HOME}/Downloads/vector
   

   as user could have app itself in any directory and the app directory itself should not be allowed to be rewritten by app or firejail if security vulnerability, then must be whitelisted and market as read only too.

    cd ~/path/to/vector/download/ && firejail --whitelist=`pwd` --read-only=`pwd` --profile=~/.config/firejail/vector.profile --ignore=seccomp proxychains4 ./vector
   

   Just my little recommendations. because otherwise the effect of isolation is near zero.
8. JSKitty commented on Jan 25, 2026

   

   JSKitty

   on Jan 25, 2026

   More actions

   I've pushed some improvements to the profile and docs, tested to the best of my ability; some areas of the app do not run perfect and some features had to be disabled, but this is the best I could do for now: 019c9be