Isolation Manager
Choose how an application runs, discover Firejail-ready software, maintain your own application list, and inspect real sandbox and container state from one seven-destination GTK window.
The decision every application row asks
Native
Runs the host application directly and unconfined. Use it only when isolation is incompatible or deliberately unnecessary.
Firejail
The default for reviewed applications. Runs the application through Kodachi's validated Firejail launcher and an installed profile or explicit fallback.
Podman
Runs a compatible command in a rootless container. The current container does not expose X11 or Wayland, so graphical applications show Podman as unavailable.
- Open Containers -> Isolation Manager.
- On Applications, find the program and read the selected runtime.
- Keep Firejail for the reviewed default, choose Native only with its unconfined consequence understood, or choose Podman for a compatible terminal.
- Press the Launch control, whose label names the selected runtime.
- If a runtime is disabled, read the stated reason. The missing prerequisite or incompatibility is intentional, not hidden.
The reviewed list currently contains LibreWolf, KeePassXC, Electrum, Monero Wallet GUI, Thunar, Double Commander, XFCE Terminal, and XTerm. Podman is available only for the two terminal rows. The six graphical rows refuse it because the container has no display socket.
Isolation reduces a boundary, not every risk
A sandbox or container does not make an untrusted file, browser session, extension, credential, or network destination safe. Keep the application updated and review what data you expose to it.
Every destination in the current window
Applications
The reviewed set. Each row shows Native, Firejail, and Podman compatibility, with Firejail selected by default.
More applications
Discovers installed programs that also have installed Firejail profiles. It avoids duplicates from the reviewed set and reports scanned versus launchable counts.
My applications
Add a display name and executable, launch it through the same allowlisted adapter, or remove only the catalog entry.
Containers
Manage the disposable shell, persistent workbench, and the Kodachi-labeled container fleet.
Running now
Reads current Firejail sandboxes and managed containers. Controls act on the exact process or container identifier shown in the row.
Images
Shows the container image actually present and the offline archive and metadata prerequisites used to restore it.
Profiles
Distinguishes dedicated installed profiles from default-profile fallback and keeps Firetools plus the configuration wizard available as expert tools.
Add an application to My applications
- Open My applications.
- Enter a clear display name.
- Enter a bare executable name available on the system path, or an absolute executable path.
- Review the resolved program shown by the window, then add it.
- Choose a supported runtime and launch it. The adapter accepts the stored identity, not an arbitrary command line.
The personal catalog is stored for your user in ~/.config/kodachi/isolation-apps.json with private permissions. Removing a row removes the catalog entry. It does not uninstall the program or delete its data.
Typed form content survives refresh
If the page refreshes while you are entering a name or executable, the fields are preserved. If a previously added executable later disappears, the row stays visible but cannot be launched.
Why some discovered profiles are not launchable
A Firejail profile can be installed even when its application is not. More applications offers only programs that have both a profile and a resolvable executable. The counts explain the difference.
Manage containers without touching unrelated Podman workloads
| Action | Scope | Consequence |
|---|---|---|
| Disposable shell | One temporary Kodachi container | The environment is deleted after the session exits. |
| Persistent workbench | One managed workbench | Its container filesystem survives stop and start. |
| Status | Bundled image and managed containers | Read-only verification of the image and current managed state. |
| Start all | Containers carrying the managed Kodachi label | Starts the reviewed fleet only. |
| Stop one | The exact container ID in a Running now row | Interrupts processes in that container. |
| Stop all | Persistent managed containers | Interrupts open work but deliberately spares disposable shells. |
| Reset workbench | The persistent workbench | After terminal confirmation, removes the workbench and its content but not the image or unrelated containers. |
Control a running Firejail sandbox
Running now reads sandbox state and binds its shutdown control to that row's process identifier. Refresh after an action to replace the page with a new live reading.
Save before Stop or Reset
Stopping a container or sandbox can terminate active programs. Reset Podman Workbench is a recovery operation and can destroy workbench-only data.
Missing and unknown have specific meanings
| Message | Meaning and next step |
|---|---|
| Podman unavailable | The executable is absent. Native and Firejail remain available. This is different from a graphical row refusing Podman because the container has no display. |
| Image archive or metadata missing | Podman readiness requires three items: the executable, offline image archive, and image metadata. Read Images for every missing path and supplier. |
| No display socket | The rootless container intentionally has no X11 or Wayland display. Use Firejail for a graphical application or Podman for a terminal. |
| Runtime state unavailable | The system read failed. The page refuses to convert that failure into an empty list. |
| Default Firejail profile | No dedicated application profile is installed. Firejail's default policy applies. |
| Executable not found | The custom or discovered application cannot resolve to an executable. Correct the entry or install the program. |
| Action failed | Read the command's own output shown on the row, correct the named prerequisite, then refresh. |
For direct Podman shortcuts, see Cairo Dock -> Containers. For the shared GTK interaction model, see GTK Control Center.