Vector does not work with firejail and proxychains security isolation

[nnmfnwl]

System: Debian Latest Stable
Vector: v0.2.0 and v0.1.9
Initiating firejail sandbox as:

cd ~/Downloads/vector/ && firejail --whitelist=`pwd` --read-only=`pwd` --whitelist=/home/${USER}/.config/vector/ --whitelist=~/.proxychains proxychains4 bash

Starting vector as:

~/Downloads/vector$ ./Vector
[proxychains] DLL init: proxychains-ng 4.16
Illegal instruction

Dmesg:

traps: Vector[1755281] trap invalid opcode ip:55da23616174 sp:7ffc21f08910 error:0 in Vector[55da229e0000+17ad000]
traps: Vector[1755352] trap invalid opcode ip:55f8c7eef174 sp:7ffc6fa6ab40 error:0 in Vector[55f8c72b9000+17ad000]
traps: Vector[1755459] trap invalid opcode ip:555b25a01174 sp:7ffef58a3a00 error:0 in Vector[555b24dcb000+17ad000]

I haven't tested to start Vector without isolation because not trusting third party software without proper isolation.

Would be great at least to know which userspace directories is Vector using and if it works with Debian latest stable as native.

[JSKitty]

gm @nnmfnwl and thanks for your report!

The directories Vector requires and use out-the-box are:
~/Downloads/vector/* (where all your downloaded media is stored).
~/.local/share/vector/* or ~/.local/share/io.vectorapp/* (Vector config and DB stores).

There may also be WebView cache stored in your cache directory, but I'm not sure where exactly this is stored by webkitgtk specifically.

Worthy note: Vector should run on Debian fairly well, though playable media may not be functional yet due to WebKit limitations on Linux.

If you hit any snags, let me know, the experience on Linux is not the greatest right now. 🙏

[nnmfnwl]

gm @nnmfnwl and thanks for your report!

Thanks for you reply

The directories Vector requires and use out-the-box are: ~/Downloads/vector/* (where all your downloaded media is stored). ~/.local/share/vector/* or ~/.local/share/io.vectorapp/* (Vector config and DB stores).

Thanks!

There may also be WebView cache stored in your cache directory, but I'm not sure where exactly this is stored by webkitgtk specifically.

The firejail makes home directory isolated, so it seen from app perspective as empty

Worthy note: Vector should run on Debian fairly well, though playable media may not be functional yet due to WebKit limitations on Linux.
If you hit any snags, let me know, the experience on Linux is not the greatest right now. 🙏

Did someone give it try to test it on latest Debian stable?

[JSKitty]

I've only tested and very lightly developed it on Arch myself (and someone else I know has used it on Arch, as well), everything aside from playable media is nicely smooth, I have little feedback from Debian users yet, but curious to know how it goes!

[nnmfnwl]

I've only tested and very lightly developed it on Arch myself (and someone else I know has used it on Arch, as well), everything aside from playable media is nicely smooth, I have little feedback from Debian users yet, but curious to know how it goes!

At least you could install firejail (https://wiki.archlinux.org/title/Firejail) and proxychains (https://archlinux.org/packages/extra/x86_64/proxychains-ng/)

And try to run Vector bin or Appimage on your system to confirm if issue could be app isolation or operating system itself, by the way Debian stable version been updated "few" days ago.:

 cd ~/Downloads/vector/ && proxychains firejail --whitelist=`pwd` --read-only=`pwd` --whitelist=/home/${USER}/.config/vector/ --whitelist=~/.proxychains --appimage Vector_0.2.0_amd64.AppImage --no-zygote --no-sandbox --disable-gpu

or

 cd ~/Downloads/vector/ && proxychains firejail --whitelist=`pwd` --read-only=`pwd` --whitelist=/home/${USER}/.config/vector/ --whitelist=~/.proxychains ./Vector

or without tor support

cd ~/Downloads/vector/ && firejail --whitelist=`pwd` --read-only=`pwd` --whitelist=/home/${USER}/.config/vector/ ./Vector