How to configure firejail to make FUSE mounts visible outside of the sandbox?

[saltiniroberto]

I am trying to build a custom profile for Cryptomator which uses FUSE.
The problem that I am facing is that, even with the --noprofile option, even though the FUSE mount does not seem to throw any error, I cannot see the mounted files outside of the sandbox.

I have run a simple test executing
firejail --noprofile bash
Then, in the sandboxed shell I execute
firejail --noprofile bindfs dir1 dir2
This command terminates and withing the sandboxed shell I can see the content of dir1 in dir2.

However, I cannot do so outside of the sandbox.
Is there any way to fix this?

[rusty-snake]

Perform the FUSE mount in the initial mount namespace.

[saltiniroberto]

Perform the FUSE mount in the initial mount namespace.

Apologies, but I am not sure what you mean by this.
Do you mean performing the FUSE mount before launching firejail?
Or do you mean using the firejail --bind option?
Or do you mean something completely different?

[rusty-snake]

IDK the internals of cryptomator but but mounts that are performed inside firejail will never show up on the host.

Hence the problem is not no-access (permission) but invisible (not mounted).

[saltiniroberto]

IDK the internals of cryptomator but but mounts that are performed inside firejail will never show up on the host.

Hence the problem is not no-access (permission) but invisible (not mounted).

Thanks for the clarification. I have updated the title accordingly.

Is overcoming this limitation something that firejail might address somehow in the future?

[rusty-snake]

Is overcoming this limitation something that firejail might address somehow in the future?

At the day when landlock has all the required features in order to drop the mount based filesystem restrictions.

_{or if we replace it with an eBPF implementation}