The extras

Optional programs, one script each in extras/. Nothing here is installed unless you choose it.

Each one has a page in extras/: its commands, what it is, what it doesn't protect against, and those manual steps.

Browsing the web

firefox-sandbox: firefox is Firefox as its own locked-down user (firefox), as a normal window.

• Your logins and history are kept in that user's home, not yours; a hacked page reaches only that, not your files.
• Clipboard shared while it has focus; ~/Downloads shared both ways; sound through a pipe (it cannot hear your microphone); firewalled off your router and local services; links from other programs open in the running window.
• firefox-unsafe runs Firefox as you; firefox-esr (and x-www-browser) open the sandboxed one. More below.

tor-browser: Tor Browser as its own user, in a window of its own (Safest, JavaScript off, a bridge before its first connection if you need one: obfs4, webtunnel, Snowflake or meek). More below.

tor-browser-unsafe: a second Tor Browser, its own user, at Safer (JavaScript on https sites) for sites that need it, kept apart from the Safest one so a hacked page can't reach its files. Its address bar and tab are red, as a reminder. Needs tor-browser first.

mullvad-browser-sandbox: Mullvad Browser as its own user: Tor Browser's anti-tracking without Tor, for use with a VPN

w3m: w3m, a text-mode web browser for the terminal (no JavaScript)

Privacy and anonymity

whonix: Whonix Gateway + Workstation VMs on KVM. More below.

mullvad-vpn: Mullvad VPN (app and mullvad command), from Mullvad's signed apt repo.

• Prints mullvad examples

onionshare: Share files, receive files, host a site or a chat over Tor, with a bridge if you need one (obfs4 or Snowflake).

• Prints onionshare-cli examples

onion-site: Your own onion site, able to run more than static files: nginx in front and your own app server, or a Python (Flask) app run by gunicorn.

• It runs in a VM with no network at all, so nothing the site does can give away your address; only Tor on this computer reaches it.
• Public, or private with client keys.
• Needs KVM. More below.

apt-tor: apt downloads Debian's packages through Tor, over https, so your network doesn't see which packages you get and Debian's mirrors don't see your address. Signatures are checked either way; it is slower. Asked as "Network privacy" during the install, or later here.

remote-access: ssh into this computer from another one over a Tor onion service, with no firewall port opened. sshd listens on 127.0.0.1 only (keys only, your user only) and the onion service needs a client key.

• Shows the address and the exact setup lines for the other computer. More below.

metadata-cleaner: Metadata Cleaner, the graphical program Tails ships, and the mat2 command: removes hidden metadata from photos, PDFs and documents before you share them.

• Prints examples

Passwords, keys and backups

keepassxc: KeePassXC password manager, the minimal build (keepassxc-minimal): no browser integration and no Firefox add-on, so no web page can talk to it; copy and paste a password, or use auto-type.

• On a computer with the full build and the add-on, running it again switches to the minimal one

security-key: A FIDO2 hardware security key (YubiKey, Nitrokey...): SSH keys that need it (ed25519-sk), website logins in the sandboxed Firefox if you say so, and sudo with your password and a touch (--sudo), tried first and undone by itself unless it works.

vault: ~/Vault, an encrypted folder (gocryptfs) with its own password: vault open opens it for an hour (--for 2h, --no-timeout), and it closes itself when its time is up or the screen locks (idle, before sleep, Super+Escape, the lid).

• Closed, its key isn't in memory, so a laptop taken while on and locked doesn't give its files away.

backup: Encrypted backups of your home folder with restic, and a backup command.

• Prints examples

signing-key: In a git copy only (see wren-dev.sh).

• Wren Linux's signing key, for the computer you publish Wren Linux from: wren-key makes it (the first run explains and asks), writes an encrypted backup of the whole key to your USB stick, and keeps only the signing subkey here, held by its own user wren-signer with no network, that your user can't read; signing asks for your sudo password.
• Then git signs every commit with it, pins.sh pins it and wren-key sign-repo signs the apt repository.
• See extras/signing-key.md and man wren-key

Messages

signal: Signal Desktop, from Signal's signed apt repo (updated by unattended-upgrades), linked to your phone's Signal; its sandbox helper isn't setuid root.

• Command: signal-desktop.

Pictures, video and files

media: imv (images) and mpv (video, music), each started in a bubblewrap sandbox that sees only the files you open.

• Prints examples and keys

pdf-viewer: zathura PDF viewer, in a sandbox

gimp: GIMP image editor, in a sandbox: ~/Pictures to open and save in, no network

yt-dlp: yt-dlp, the video downloader, as its own locked-down user (ytdlp): yt-dlp URL works as usual and the files land in ~/Downloads, copied out as you.

• The official release, checked against yt-dlp's pinned signing key and installed as root's file (it can't change itself); YouTube's JavaScript runs in Debian's QuickJS, as ytdlp; config files ignored; a firewall rule keeps it off your local network.
• Run it again to update yt-dlp.

grim-slurp: screenshot and its keys (packages: grim, slurp)

file-manager: Thunar, a light graphical file manager, with Trash and thumbnails (made the default for folders).

• Prints its keys

mousepad: Mousepad, a simple graphical text editor (made the default for text files).

• It also sets its look: white text on black in the terminal's colours with dark menus, DejaVu Sans Mono 14, tabs of 4 spaces, line numbers, matching braces highlighted and a line at column 80 (data/mousepad.settings, data/mousepad-dark.xml); later runs leave your changes alone unless Wren Linux's settings changed

archive-tools: unzip, zip, 7z, bzip2 and zstd for archives

wallpapers: Fills ~/Pictures/Wallpapers with pictures that come with Wren Linux: wrens, art, Earth and space. Stronger ones only if you tick them

Coding

claude-vm: The claude-vm command runs Claude Code inside a disposable Debian VM (QEMU/KVM, built with mockvps-kvm), so a kernel bug that would escape a user-level sandbox only reaches a VM you can delete (does this computer have KVM?).

• No shared folder — the agent hands work back only as its branch claude, which claude-pull fetches over the VM's ssh login and shows you before bringing in (it installs claude-pull).
• The VM reaches the internet but nothing on your machine or network (a firewall on its claude-vm user).
• Needs KVM.
• Type claude-vm in a terminal or in wmenu (Super+d), which opens it in its own foot window.
• It boots the VM if it is off (about a minute, with progress shown; and it powers itself off when you exit, unless another window is still connected; claude-vm stop does it by hand).
• Running it again (as update.sh offers to) keeps a VM that is already built, with whatever is unpushed in it; claude-vm rebuild makes a fresh one.
• --account NAME adds another account (its own Claude login and memories) in a VM of its own, run by its own user claude-vm-NAME, with its own console port that only it may reach: claude-vm --account NAME.
• See THREAT-MODEL.md

git: git; then wrenctl git sets your commit name and email and how you log in to push

vim: Debian's full vim, with colors for each programming language, and a ~/.vimrc (light or dark with the theme, modelines off)

wren-dev: For working on Wren Linux itself, on the computer where you build its package: lintian (Debian's package checker, which tools/build-deb.sh runs) and shellcheck (which test.sh runs), and a git copy in ~/wren-linux, which has what the package leaves out (tests, build tools, the signing key).

• Not in the base: lintian brings over a hundred packages that other computers never use

mockvps-kvm: mockvps-kvm: a disposable Debian "VPS" in a local QEMU/KVM VM for trying out server setups, with snapshots and one-command removal.

• See vendor/mockvps-kvm/README.md.
• Run wrenctl install mockvps-kvm once, then use the mockvps-kvm command; the script in vendor/ is the program itself and refuses to run directly until that setup is done (MOCKVPS_FORCE=1 overrides)

Your computer

pipewire-audio: Sound.

• timer and the alarm clock ring with pw-play (part of PipeWire) and Wren Linux's own bell sound (an alarm repeats it for up to 5 minutes; click or dismiss the notification, or timer stop, to end it); without sound set up they only show a notification, and say so.
• The microphone is muted at every login and stays off until you switch it on (Wren menu > Microphone, or wrenctl --mic on); that is software muting, so a program running as you could unmute it, and a hardware switch is stronger.
• volume up|down|mute|micmute [STEP] (5% steps, never above 100%, unmutes on a change, refreshes the bar); the volume and mute keys use it, and Super+F10 / F11 / F12 (mute / down / up) do for keyboards without them (packages: pipewire-audio)

bluetooth: Bluetooth for headphones, keyboards and mice (bluez; bluetoothctl pairs).

• The adapter starts off at every boot; switch it from the Wren menu or wrenctl --bluetooth on.
• With sound set up, also installs PipeWire's Bluetooth audio

webcam: A webcam switch: a USB camera (most laptops' built-in ones) starts off at every boot and when plugged in, and the Wren menu gets a Webcam line (wrenctl --camera on|off).

• Off disconnects its USB device, as if unplugged.
• A root helper does it; your user may run it with on or off only.

phone-tethering: Use a phone's mobile data over the USB cable (usbmuxd and the iPhone pairing tools; Android needs nothing but its own "USB tethering" switch).

• Switch Wi-Fi off from the menu to use only the phone

zram: Compressed swap kept in memory, for more room, nothing on disk.

lid-awake: Closing the lid no longer suspends the laptop (Debian's default does): it locks the screen and turns the laptop's own panel off, while the network, downloads and the timer's alarms keep going; an external screen stays on.

• A systemd-logind setting (HandleLidSwitch=ignore, plugged in and docked too) and sway's lid switch (bin/lid).
• It keeps running in a closed bag, getting warm: power it off before packing it

one-workspace: One workspace: Super+1 … 0 and Super+Shift+1 … 0 do nothing and the bar shows no workspace buttons, so no window ends up out of sight (make-install-iso.sh --simplesway ticks it in the first install list)

console-only: log in to tmux (the same bar and keys) instead of starting sway

autologin: Log in on tty1 without your password, straight into sway (the disk passphrase, the screen lock and sudo still ask).

• Warns and asks first on a disk that isn't encrypted.

emoji-font: Color emoji (packages: fonts-noto-color-emoji)

• wrenctl takes its own runs' changes.

Other systems

get-iso: get-iso downloads Debian, Tails, Kicksecure or Qubes (through Tor when Tor runs here), keeps it only if it is the newest release and its project's pinned key vouches for it, and offers to write it to a USB stick you pick and type the name of.

tails-usb: tails-usb downloads the newest Tails (through Tor when Tor runs here), uses it only if it is signed by the pinned Tails key and is the current release, writes it to a USB stick you pick and type the name of, and reads it back to check.

Retired and removed

These were taken out of Wren Linux: they can't be installed, update.sh doesn't run them again, and what is left of each is its --remove, which update.sh offers to anyone who still has one (and wrenctl remove NAME runs). Your own files are never deleted by it: the wallets stay in /var/lib/wren-wallet, a VM's disk and images stay in its user's home unless you say to delete them, and ~/projects is untouched.

• claude-regular and claude-code (Claude Code as you, or as its own user): an AI agent belongs behind the strongest wall Wren Linux has. Use claude-vm.
• opencode-vm: a second copy of claude-vm's machinery, for little use.
• distro-vm (Kali, Tails and Arch in VMs): a lot of root-run machinery for rare use. Tails is safer on a stick of its own: wrenctl install tails-usb.
• udiskie (USB drives mounting by themselves): a stick is read the moment it is plugged in, before you decide to trust it. usb mount and usb unmount (in the base) mount one as you when you ask, LUKS included.
• seahorse (the GNOME keyring, unlocked at login): any program running as you can ask it for its secrets. wrenctl install keepassxc asks for its own password.
• electrum and feather-wallet (wallets as you): Whonix is the safer place for them, behind Tor (wrenctl install whonix).
• sparrow-wallet (Sparrow as you): the same. Sparrow's own Tor setting sends its connections through Tor, but the wallet still runs as you, next to all your files.
• simplex-chat (SimpleX Chat as you): it is moving into Whonix's Workstation, behind Tor and apart from your files (wrenctl install whonix). The Whonix build isn't ready yet.
• hardware-wallet (a udev rule for wallets over USB): the wallets it paired with are retired from the desktop. For most people the simpler key is the seed words on paper or metal, backed up on an encrypted USB stick (usb mount unlocks LUKS).
• Kali, Parrot and Arch in get-iso: images for other systems that are rarely wanted from here.
• wallet-sandbox (wallets as their own users): Whonix is the safer place for wallets (Feather and Electrum come in its Workstation, behind Tor): wrenctl install whonix.
• mullvad-browser-regular (Mullvad Browser as you): a hacked page in it reaches all your files. The same browser as its own user has a wall in between: wrenctl install mullvad-browser-sandbox.

Not included: a BitTorrent client. BitTorrent always shares: every client uploads to the other peers while it downloads, and announces your IP address to everyone sharing the same files. What's legally offered as a torrent (Linux images, archive.org, Blender's films) is almost always a plain download too, which only that site sees.

Does this computer have KVM?

claude-vm needs it. Both of these should succeed:

grep -cE 'vmx|svm' /proc/cpuinfo     # a number above 0: the CPU can do it
ls -l /dev/kvm                       # the file exists: the kernel can too

No /dev/kvm usually means one of: virtualization (Intel VT-x or AMD-V) is switched off in the BIOS/firmware, the CPU is too old, or Wren Linux itself is running inside a VM that doesn't pass virtualization through. The first is fixable in the BIOS; the others mean claude-vm can't run here, and Wren Linux offers no other way to sandbox Claude Code.

What the VM doesn't protect: the internet (the agent can still send anything it can read to anywhere), and what you pull from it. Read what it leaves before you run it. See THREAT-MODEL.md.

The sandboxed Firefox (extras/firefox-sandbox.sh)

firefox opens Firefox as a different Linux user, so a browser exploit lands in a user with no password, no login and none of your files. It looks like any other window. What is shared with you, and what is not:

It also becomes your default browser: links from other programs (a terminal, a file manager) open in it, because the desktop entry wren-firefox.desktop is set as the handler for web links in ~/.config/mimeapps.list (undone by --remove).

firefox-unsafe runs the same Firefox as you, with everything you can reach, if the sandbox is ever in the way: Debian's firefox-esr is moved there (with dpkg-divert, so its updates land there too), and firefox-esr by name, /usr/bin/firefox and x-www-browser open the sandboxed Firefox, so nothing starts the unsandboxed one by accident. --remove puts firefox-esr back. Profiles made with firefox-profiles/new-profile.sh each get a user of their own like this one (fx-NAME), so a hacked page in one reaches neither your files nor the other profiles; they share the one firewall rule through the group wren-fx.

Your onion site (extras/onion-site.sh)

A website at a .onion address, served from this computer, for sites that need more than static files. The most common way an onion site gives away where it runs is its own software reaching out to the internet (an image, a font, an update check, an email, a DNS lookup), so here the site runs in a VM that can't reach any network at all:

Tor Browser → Tor network → Tor on this computer → 127.0.0.1:18080 → the VM: nginx → your app

• The VM is built with the bundled mockvps-kvm and run by a locked user, onion-site, like claude-vm. After its first setup QEMU runs it with restrict=on: the guest can't send a single packet out. Two ports on this computer's loopback lead in: its SSH console (2243) and its nginx (18080). A firewall rule on the onion-site user keeps even the QEMU process off your network.
• Inside, nginx serves /srv/site/static and passes everything else to the app on 127.0.0.1:8000. It shows no version and keeps no access log; the time zone is UTC. You pick the app when you set it up:
• any: you run your own app server on 127.0.0.1:8000 (onion-site shell);
• python: gunicorn runs a Flask app (app.py with app = Flask(...)) as a locked-down service; a small one is there to start from. Anything the app keeps goes in /srv/site/data.
• Public or private, also chosen at setup. Private: only visitors you give a client key can find the site; Tor Browser asks for the key the first time.
• Tor is the system tor service on this computer (shared with apt over Tor and remote access, with your bridge if you need one), with Tor's defences against floods of visits. Its config is checked before Tor restarts.
• No shared folder. onion-site upload static FOLDER and onion-site upload app FOLDER send a folder in; it replaces what was there.
• Updates. onion-site update restarts the VM with one more way out, a relay to this computer's Tor for apt only, upgrades it, and restarts it without that.

The app can't fetch anything from the internet, ever: no packages from pip or npm at run time, no outside images or fonts, no email. What it needs goes in with upload, or comes from Debian during onion-site update.

What it can't hide: the site is only up while this computer is on and the VM runs (it starts at every boot; onion-site stop and start by hand), and that timing can link it to you; a dedicated machine is the right host for anything serious. A hole in your app gets the VM and the site's data, not this computer. Back up /var/lib/tor/wren-onion-site (as root) to keep the address; --remove asks before deleting it.

Remote access (extras/remote-access.sh)

For logging in to this computer from another one without opening a port: the firewall stays closed, and nothing on the local network can reach ssh.

• What it sets up. openssh-server listening on 127.0.0.1 only (key login only, root login off, only your user), and a Tor onion service that passes port 22 through to it. Tor connects outward, so ufw is unchanged. It asks first whether you need a bridge, like apt over Tor.
• Who can connect. Only a computer that has the client key. The onion service uses Tor's client authorization, so without the key it can't even be found. The key is made here and shown once; only its public half is kept on this computer. Your own ssh key still has to be accepted (~/.ssh/authorized_keys; it asks you to paste one if there is none).
• On the computer you connect from, install tor and netcat-openbsd, put the key line in Tor's ClientOnionAuthDir, and add a Host block with ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p to ~/.ssh/config. The script prints all of it, ready to paste.
• Run it again to see the address or to authorize another computer (a new client key). The address stays the same as long as /var/lib/tor/wren-ssh does; back that folder up (as root).
• If you're logged in over ssh when you run it, it warns you: ssh moves to 127.0.0.1, so that way in closes. Use Tor, or the machine's own screen.
• --remove stops it, deletes the onion address for good (it asks first) and purges what it installed. The ssh server stays if you had it before.

Turn it on only if you need it: it is a service that other computers can try to reach, even if only the holder of your keys can get in.

extras/firefox-profiles/

bash extras/firefox-profiles/new-profile.sh gives a website you stay logged into (a bank, email, shopping, a work account) its own Firefox profile and a command named after it (bank, or firefox-bank when a program has that name). See extras/firefox-profiles/README.md for why that's useful.

Firefox (extras/firefox-sandbox.sh)

Installs Firefox ESR with the video codecs and uBlock Origin, runs the hardening below, runs it as its own locked-down user (firefox), and sets up incognito too. firefox-unsafe runs the same Firefox as you, for the odd page the sandbox's firewall blocks (your router's, say). wrenctl remove firefox-sandbox takes all of it out again (it asks about incognito; your profiles stay).

Firefox hardening

extras/firefox-sandbox.sh runs parts/firefox-hardening.sh, which sets these for every Firefox profile:

• uBlock Origin, in the mode you choose at install: standard blocks ads, trackers and known malware sites with its filter lists, and sites work. "Medium mode", the default, also blocks scripts and frames from other sites everywhere. That's where most malicious ads and drive-by attacks come from, and most trackers. Some sites break then: ublock-allow example.com gives one standard mode, where the filter lists still block ads, trackers and malware sites (then restart Firefox). ublock-allow --mode standard|medium switches later. ublock-allow --list and ublock-allow --remove example.com manage the list. Changes made by clicking in uBlock's popup work too, but only until Firefox restarts, because uBlock re-reads Wren Linux's rules at every start.
• The JavaScript JIT is off. Most serious Firefox exploits target the JIT, the part that turns JavaScript into fast machine code. JavaScript still works, just slower; heavy web apps can feel sluggish. Turn it back on for one site by giving it its own profile with fast JavaScript (extras/firefox-profiles/new-profile.sh).
• Cookies and site data deleted when it closes (the sandboxed Firefox's default; its install asks): websites, and the trackers behind them, can't recognise you from one visit to the next. Sites you allow under Settings > Privacy & Security > Cookies and Site Data > Manage Exceptions keep theirs, so you stay logged in to those. History, bookmarks and saved passwords stay: no website can read them.
• Saved passwords fill in on a click, not as the page loads: tracking scripts have added hidden login boxes to read what Firefox filled in.
• No "save this password?": Firefox never offers to save a password, nor makes one up or offers Relay addresses. KeePassXC (wrenctl install keepassxc) keeps them, encrypted with your own passphrase and apart from the browser that pages run in. Logins saved before stay in Firefox's list (Settings, Passwords), so you can move them over.
• A "Learn (Wren Linux)" bookmarks folder, read-only and apart from your own bookmarks: Linux and the command line, Bash, sed and awk, security and privacy, programming and full-stack web (data/firefox-bookmarks.json).
• HTTPS-Only Mode: Firefox won't load an unencrypted page without asking first, so nobody on café or hotel Wi-Fi can tamper with it.
• Its DNS, encrypted either way (set at each start, never a provider Firefox picks itself): with secure DNS on, its own DNS-over-HTTPS is off and it looks names up the way the rest of the system does, encrypted; with it off, Firefox encrypts its own lookups to Quad9 (DNS over HTTPS), strict by default (never plain DNS) or with fallback to the network's, as chosen at the sandboxed Firefox's install. Every Firefox Wren Linux runs gets this, incognito and the sandboxed firefox included, except the Wi-Fi sign-in window (wifi-signin), which uses the network's DNS so a sign-in page can load, and is thrown away when it closes.
• A notice when Firefox needs a restart: after an update, the running browser keeps the old, unfixed version until you restart it. A check every 10 minutes shows a notification when that's the case.

How: default prefs in /etc/firefox-esr/wren-hardening.js (any profile can change them at about:config), a uBlock and DNS policy in /usr/share/firefox-esr/distribution/policies.json (only written if no other policies file exists), and a systemd user timer. bash parts/firefox-hardening.sh --remove undoes all of it.

incognito

incognito opens Firefox as a different, locked-down user, for sites you don't trust or don't want tied to the rest of your browsing. incognito https://example.org/ opens a page. wifi-signin (the Wren menu's "Wi-Fi sign-in") opens it as the Wi-Fi sign-in window: the network's own DNS and plain http allowed, for a café's or hotel's sign-in page, with secure DNS off only while it is open. What parts/incognito.sh sets up:

• A user with nothing: no password, no login, no home folder on disk, no group but its own and render (so no sound card, no USB; render lets cage open the graphics card's render node, which it needs to start, but not take over the screen), and a limit on how many processes it may start. It can't read your files.
• Its own window system: Firefox runs inside cage, a tiny Wayland compositor that appears as one window in sway. The clipboard belongs to the window system, so what you copy in your programs can't be pasted there, and the other way round. There is no shared folder: a download stays in memory and is gone when the window closes.
• Nothing kept: the profile, cache, cookies and history live in memory (/dev/shm) and the folder is deleted when you close the window; the profile is always in private browsing, with tracking protection and fingerprinting resistance on and WebRTC off (data/incognito-user.js; some sites break with fingerprinting resistance, turn it off there). Wren Linux's defaults for every profile still apply: HTTPS-Only Mode, no JavaScript JIT, uBlock Origin.
• Sound and video: YouTube and the like play, with sound. incognito has no sound card, so it runs its own small audio server (PipeWire) whose only output is a pipe; a player running as you (pw-cat, shown in your volume control as a normal stream) reads that pipe and plays it through your speakers. The pipe carries sound in one direction only, so the window can't hear your microphone or your other programs, and your audio server is never reachable from it. Rendering is in software, so the CPU decodes the video: 720p is comfortable, 1080p may stutter, and sound can drift a fraction of a second behind the picture. Protected (DRM) video doesn't play. incognito --no-audio leaves the pipe out. If uBlock's medium mode (if you chose it) breaks a player, ublock-allow site.com applies here too.
• Off your network: a firewall rule that matches only the incognito user (data/incognito-firewall.nft, loaded at every boot) turns away its connections to your router, printers, other computers on the local network and to programs listening on this machine (including Tor Browser's proxy). DNS and the internet stay open, over IPv4 only: on a network with global IPv6 addresses a fixed rule can't tell the router from the internet, so the sandbox users get no IPv6 (on an IPv6-only network they get no internet). Wi-Fi sign-in pages are often on the local network, so the Wi-Fi sign-in window runs as a second such user, wifi-signin, whose own rule (data/wifi-signin-firewall.nft) lets it reach the local network but not this computer. That user runs only the sign-in window, and the two can be open at the same time.
• A narrow door: your user may run one thing as incognito (and as wifi-signin), the wrapper /usr/local/libexec/incognito-session, through a rule in /etc/sudoers.d/wren-incognito that was checked with visudo. The incognito command gives that user a restricted Wayland socket only while the window is open, and takes it away afterwards. It is made with sway's security-context protocol (bin/wayland-restrict): the window works, but sway doesn't offer that user the protocols that read your screen, type for you or lock the session, as your real socket would. media-sandbox (imv and mpv) uses the same kind of socket.
• No way into X11: XWayland (installed for Tor Browser, Feather and other X11-only apps) listens on an "abstract" socket that every user on the computer can connect to, and anyone connected to X11 can read its windows and type into them. incognito, claude, claude-vm, the sandboxed Firefox, the onion site, yt-dlp and a media viewer given a web address start through /usr/local/libexec/wren-no-abstract-sockets, which uses the kernel's Landlock (Linux 6.12 or newer, Debian 13's own) to stop them connecting to abstract sockets made outside them. Files, the network and their own sockets are unaffected. On an older kernel they refuse to start (WREN_ALLOW_ABSTRACT_SOCKETS=1 runs one without it).

What it doesn't do: it uses your network and your IP address (use Tor Browser or a VPN for that), and it uses the same kernel, so a kernel bug could get out of it. Pages are drawn by software, so heavy sites are slower. The keyboard layout inside it is the US one. Remove it with bash parts/incognito.sh --remove, which also deletes the user.