Runs PROGRAM inside a sandbox.
-a <table> Run using the alternate syscall table named <table>. Only available on kernels and architectures that support the PR_ALT_SYSCALL option of prctl(2).
-b <src>,<dest>[,<writeable>] Bind-mount <src> into the chroot directory at <dest>, optionally writeable.
-c <caps> Restrict capabilities to caps. When used in conjunction with -u and -g, this allows a program to have access to only certain parts of root's default privileges while running as another user and group ID altogether. Note that these capabilities are not inherited by subprocesses of the process given capabilities unless those subprocesses have POSIX file capabilities. See capabilities(7).
-C <dir> Change root (using chroot(2)) to <dir>.
-e[file] Enter a new network namespace, or if file is specified, Enter an existing network namespace specified by file which is typically of the form /proc/<pid>/ns/net.
-f <file> Write the pid of the jailed process to file.
-t Mounts a tmpfs filesystem on /tmp. /tmp must exist in the chroot. This must be used with -C. The default filesystem has a max size of 128M and has standard /tmp permissions (777).
-G Inherit all the supplementary groups of the user specified with -u. It is an error to use this option without having specified a user name to -u.
-g <group> Change groups to group, which may be either a group name or a numeric group ID.
-h Print a help message.
-H Print a help message detailing supported system call names for seccomp_filter. (Other direct numbers may be specified if minijail0 is not in sync with the host kernel or something like 32/64-bit compatibility issues exist.)
-l Run inside a new IPC namespace. This option makes the program's System V IPC namespace independent.
-m "<uid> <loweruid> <count>[,<uid> <loweruid> <count>]" Set the uid mapping of a user namespace (implies -pU). Same arguments as newuidmap(1). Multiple mappings should be separated by ','.
-M "<uid> <loweruid> <count>[,<uid> <loweruid> <count>]" Set the gid mapping of a user namespace (implies -pU). Same arguments as newgidmap(1). Multiple mappings should be separated by ','.
-p Run inside a new PID namespace. This option will make it impossible for the program to see or affect processes that are not its descendants. This implies -v and -r, since otherwise the process can see outside its namespace by inspecting /proc.
-P <dir> Set dir as the root fs using pivot_root. Implies -v, not compatible with -C.
-r Remount /proc readonly. This implies -v. Remounting /proc readonly means that even if the process has write access to a system config knob in /proc (e.g., in /sys/kernel), it cannot change the value.
-s Enable seccomp(2) in mode 1, which restricts the child process to a very small set of system calls.
-S <arch-specific seccomp_filter policy file> Enable seccomp(2) in mode 13 which restricts the child process to a set of system calls defined in the policy file. Note that system calls often change names based on the architecture or mode. (uname -m is your friend.)
-u <user> Change users to user, which may be either a user name or a numeric user ID.
-v Run inside a new VFS namespace. This option makes the program's mountpoints independent of the rest of the system's.
-V <file> Enter the VFS namespace specified by file.