Where Does Firejail Store Profiles?
Firejail reads sandbox profiles from /etc/firejail by default, with personal overrides in ~/.config/firejail taking precedence.
Last updated
Firejail profiles are plain text, and the lookup order is the whole system. System profiles ship in /etc/firejail, one per application plus shared includes. Your own copies in ~/.config/firejail win over them by filename, which is the sanctioned way to tweak rules.
Most users only ever touch two things: a program-specific profile to loosen or tighten, and disable-programs.inc style includes for broad strokes. The --debug flag prints the resolved chain, which ends arguments about which file is in charge.
Where Firejail stores this, by platform
/etc/firejail
System profiles and shared includes (disable-common.inc and friends). Copy any profile to the user folder to override it; the system copy remains as upstream reference.
~/.config/firejail
Your overrides live here by profile name. Also the place for purely personal profiles. Survives package upgrades untouched, unlike the system folder.
Frequently asked questions
How do I customize a profile without editing system files?
Copy the system profile into ~/.config/firejail and edit the copy. User profiles override system ones by name, so upgrades never clobber your tweaks and the original stays as reference.
Which profile is actually applied?
Run firejail --debug to print the profile chain it resolves. Profiles include each other (firefox.profile pulls local includes), so the effective rules come from several files, not one.
Notice an outdated path? Let us know.