Default container for opened external links

[shvchk]

External links are now opened in the same container you were in when clicking on the link, so for example if you have Google container, sites opened from search results page end up in Google container too. Would be nice to have an option to set default container (like No container or Untrusted or random new container (like with Click To Contain extension)).

[kintesh]

Well, the idea behind this extention was to open certain sites in a container and not to have certain site locked down to a container. You are free to create a PR and contiribute :)

[kintesh]

FYI: for google specifically I have these rules

*.google.com , No Container
*.google.co.co.uk , No Container

[rmenessec]

Seconded: I would really appreciate a mechanism to prevent sites without matching rules from opening in any container at all.

For example: I use a feed reader service. I have a rule set in Containerise so that Newsblur always opens in a container dedicated to Newsblur. When I click an outgoing link (destination other than newsblur.com) to read a "full article" (the original web page associated with a feed entry), I don't want the outgoing link to open in the container for Newsblur.

Currently, the only way I can do that is to set up a huge number of containers and associated rules for all the news sites whose feeds are aggregated on Newsblur. This defeats the purpose of having a container for Newsblur in the first place.

[sojusnik]

I am in the same situation, having a container for all Google services, like YouTube or Gmail. An outgoing link on these sites is still opened in the "Google" container, but I would prefer it to open in the default one. At the moment I use the context menu to open those links within the default container.

Maybe someone already has found a convenient workaround?

BTW, I think that the Temporary Containers Add-on for Firefox could provide the code for isolating certain sites to a specific container. Have a look on GitHub.

[heussd]

@sojusnik Google Container allows you to do this: it automatically opens all Google-related services in a dedicated Google-Container. Whenever you click on external links within it, the link is opened outside of the Google-Container.

[rmenessec]

@heussd, thanks for pointing that out.

Personally, I'm getting ready to disable Containers if neither Containerise nor Firefox Multi-Account Containers are going to fix this problem. And it really is a problem: there's no point in opening every Facebook URL (for example) in a Facebook container or a Google URL in a Google container if other sites' data are going to pollute the containers. That defeats the whole purpose of doing this in the first place.

Because of this severe limitation, I'm not seeing any real benefit from containers. What I'm seeing instead are bugs where both this extension and the Mozilla one sometimes fail to open configured domains / URLs in containers some of the time, isolating my login credentials (cookies, DOM storage, etc.) in one container, with some tabs for the same site opening in another container, but minus the login state.

Containers are a great idea in theory, but the implementation—and the extensions I hoped would fix it—are clearly immature at this point.

[rmenessec]

@kintesh, can you comment on when and whether Containerise will implement #4 / #10 / #21? If I don't have a way force sensitive sites into designated, isolated containers and prevent unrelated sites from polluting / accessing the containers, then the entire Firefox Containers feature is merely security theatre, and I may as well uninstall Containerise and Firefox Multi-Account Containers, rather than leaving them disabled and hoping for updates that may never come.

You are free to create a PR and contiribute :)

Learning how to code WebExtensions is not a viable option for me; nor is it a viable option for most of us.

If you prefer not to accept and work on feature requests, I'm fine with unstarring the project and moving on; I'm just looking for some certainty so that I know what my best option is.

[kintesh]

@rmenessec with v2.5.0 #4 kinda works but its case sensitive. I'll fix it in next release. #10 is I'll take a look at it soon. #21 probably not anytime soon because the current implementation is very scalable and requires more work which I don't have time for.

[rmenessec]

@kintesh, can you mitigate #21 with simple wildcard support for now? At a minimum, I need to be able to assign, e.g., *.acme.com (implied: also acme.com, no subdomain) to a container, so I don't have to create hundreds or thousands of rules just to handle mail.acme.com and calendar.acme.com and all the other variations I expect to encounter.

An even better example would be *.amazonaws.com; when I'm working with my AWS resources, I don't necessarily have control over all the host names I'm going to be browsing to; many are going to have names based on automagically assigned IP addresses, so I simply cannot create rules ahead of time to cover them.

I'm going to have enough work manually typing out a couple hundred SLD rules without any kind of automation, nor any click-to-add UI / UX... then figuring out some way to export / import rules so this works on more than one Firefox install.

[kintesh]

@rmenessec that feature was added in v2.1.0. *.domain.com works. I have *.amazon.co.uk which catches amazon.co.uk, www.amazon.co.uk and smile.amazon.co.uk to my Shopping container.

[rmenessec]

@kintesh, good to hear. I'm looking forward to #4 and #10, then. Thanks.

[sojusnik]

Any updates on this issue?

Still can't find an alternative add-on allowing us to manually define websites, that should remain within a certain container (like f.i. Google Container does for Google related sites), and open links from those sites to other non-defined sites in the default container.