Container Tabs

I would like to be able to configure my browser to open every URL in a domain-specific "container", unless I say otherwise.

Say site www.a.org includes an image from www.evilcorp.org, and www.evilcorp.org sets a cookie. When I then go to www.b.org and it includes an image from www.evilcorp.org, I don't expect the cookie to be sent back.

In other words, the cookie should be tied to www.a.org, even though it actually came from www.evilcorp.org. It should only be sent if my URL bar says www.a.org AND the image is coming from www.evilcorp.org.

I feel that this is how browsers should have been designed in the first place. I welcome this Container Tabs feature, but I don't think it quite goes far enough to restore my privacy.

This is a neat idea but it doesn't implement the main reason I use separate profiles in Chromium - different security contexts based on how much you trust a site.

Example: my main general browsing profile has flash, PDFs and all plugins disabled, absolutely all handlers switched off, all hardware access off, WebGL switched off, no account logins and uBlock Origin set to aggressively block most third-party requests.

My second most used context is for personal sites I login for - with access to third-party cookies (for those sites) and running most third-party requests with standard uBlock rules.

I have yet other contexts (Chrome profiles) where Flash is enabled if I need that, then a separate browser for Java etc.

I'd like to see these security levels built into browsers where the contexts are built around permissions and site trust rather than access to the user store (which is also important)

I don't think it's realistic for most users to do this right now with profiles, as it requires a lot of discipline - it needs to be in the UI.

Browsers have become as sophisticated as operating systems and we're accessing more and more of our personal data using them, yet the model of 'every site has access to everything' be it a site you trust, like Gmail, or a random URL you're clicking on - has somehow survived.

It's the equivalent of the old days where everyone would run their local systems with an admin account for everything. I really think browsers need a rethink along these lines where websites are treated like apps and you can apply a trust group to each.

I am a Mozilla supporter and FF is my "daily driver" browser. Very interested in this feature.

Chrome has had it for a years, and it's a killer feature for many developers. It's very very useful to have multiple browser windows open, each logged into the same site as a different user. A lot of people do this by opening multiple browsers (FF, Chrome, Edge, Safari, etc) but that has its limits and it just adds another variable my poor brain would prefer not to handle.

Also very useful for home/work separation. One browser account for work and one for home. And also maybe one for porn. So that when you're screensharing in a meeting and you type a URL into the browser, you don't get autocomplete suggestions for your favorite porn sites popping up. Happened to an old (married) boss of mine once while displaying his screen on the projector... typed "a" into the URL field and the browser helpfully suggested he navigate to AdultFriendFinder. Right in front of some clients. :)

Firefox's "container tabs" implementation may be slightly confusing. Chrome's implementation is dead simple. One identity per window, and the identity name is always displayed in the upper right.

With FF's container tabs, I'll have one identity per tab, and I can see they're color coded, but that means I'll have to mentally map colors to identities. It's more flexible than Chrome's implementation but there's more cognitive overhead involved.

Also, what's up with the name "container tabs?" That tells me nothing about what they do. All tabs... contain things. I think they need to rename it to "identity tabs" or something. How on Earth would anybody ever guess that "container tabs" is related to identities and data sharing?

We'll see how it plays out though. I'm excited to try it and I am continually grateful for Mozilla's efforts. In fact this reminds me I haven't donated to them in a while....

Right now, what I'm doing is that all my standard browsing happens on Firefox, with uMatrix blocking JS and just generally locked down. For anything where I want to log in or have a persistent identity (stackoverflow, gmail, etc), I set up separate Chrome profiles and manually open each site in the appropriate profile.

Honestly, this whole thing is a bit of a pain - my ideal solution would be one where I can set up "domain groups" matching on the URL in the URL bar, each fully isolated from one another (different extensions, settings, caches, histories, forms, cookie stores, etc), and clicking links that go from one profile to another, all referer information is stripped out. Anything not matching one of the domain groups would go to the "default session" (which I would configure to be completely locked down and ephemeral).

Additionally, I'd want a context-menu item "Open link in group <x>", which would open something matching another domain group in the domain group of my choice, so that I could do things like visit gmail in two different groups.

This is awesome. Microsoft's identity system is a nightmare so switching between my Office 365 email account and my OneDrive/music accounts is always annoying. I'd love to be able to contain each and stay logged in to both accounts.

At work I test lots of user accounts on the same site and make heavy use of Chrome profiles for that. This would fill a similar role.

But while I'm glad to have them, no average user would ever understand any of these concepts as presented in these screenshots.

This looks amazing!

I have been using Self-Destructing Cookies[1] for few years and while I think the extension is great, I always feel there's not enough isolation between tabs. For example, if I have Twitter logged in in one tab, and other tab contain Twitter button, then the other tab can still have access to my Twitter cookie. (Because Twitter tab is still active, so SDC would not destroy the cookie.) I know this is solvable using tracker blocker, but something like SDC but worked on tab container level would be very welcomed.

(Other side effect of using SDC is I seems to get the harder ReCAPTCHA that make you click an object until all of it disappear, with new ones popping up after clicking. Usually took about 5-10 clicks. Very annoying.)

[1]: https://addons.mozilla.org/en-US/firefox/addon/self-destruct...

I've been doing this for years using both Firefox' and Thunderbird's multiple-profile features.

Just run "firefox --no-remote -ProfileManager" and here you go.

So the serious question is: how is this any different from using multiple profile?

Multiple profile also have the pro/con that they are actual different processes, so there's no information leak between profiles whatsoever (well, unless some serious hacking happens).

Edit: being different processes with different profiles, they also have different configuration folders, different cookie sets, different password storage locations etc...

I would love this feature and it would actually get me to switch to Firefox in a heartbeat. I'm currently using Chrome just because of the the (subjectively) better developer tools, but this is a feature that would make my life so much easier!

I like where this is heading but their pre-selected categories don't make sense. Container isolation should be based on security requirements rather than site content. E.g. shopping and banking have similar security requirements that are different than following a click-bait link on facebook.

I'd like a container per Google account since trying to switch users in their apps is a disaster that forces me to run multiple browsers.

I'd also like to tie sites to specific containers. So supposing Banking stays its own category, that should mean that any sites that open in the Banking container will never open in another container. Similarly it should be possible to whitelist a set of sites for a container so e.g. only specific banking sites will launch in the Banking container.

Each container should have its own set of security permissions.

I'd like to have disposable containers. I want a safe space where I can open a sketchy link and not have to worry about that page doing anything to the rest of my environment.

This is why I'm using Firefox nightly. It is a killer feature to keep open my many AWS and GCP accounts (one container per client). It still needs to be polished though.

why isn't "Saved Passwords" and "Saved Search and Form data" separated between containers?

There have been autofill/form-data attacks in the past[0] and there was a story recently on HN's front page showing the same[1].

I'd like to point out that mozilla already has a configuration option to disable form data saving on https sites, 'browser.formfill.saveHttpsForms'. Why?[2]

> Right; the idea is to eliminate "opportunism". If my laptop is stolen, Firefox's current behavior makes it easy for a thief to find a https: site in my history, go to it, check out, and then just let autocomplete hand them my complete credit card details.

[0] https://news.ycombinator.com/item?id=12171547 [1] https://news.ycombinator.com/item?id=13329525 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=252486

This is really awesome!!! I used to manage this kind of separation by using private windows and using different browsers. I don't really want to manage these by window or create user profiles, as may be the case in other browsers.

I don't want to be too greedy (considering that the presence of this feature on the desktop is already great), but is there any chance that this will be coming to Firefox for Android? It might be a challenge to implement this UX-wise; however, it would also be extremely helpful since it would help in isolating mobile "web-apps" while still using a decent browser (Firefox for Android instead of Chrome), especially as profiles, which exist on the desktop version of Firefox, are not available on Android.

(Googling does not seem to have produced any relevant hits.)

Cool. I had been using multifox plugin for testing websites, but it won't work with the new multiprocess engine and the plugin author had no intention of porting it. Glad to see an alternative.

I use Firefox for testing my dev work but reading about the privacy use-case, I might seriously consider switching from Chrome as my main browser.

I've been using the Private Tab addon to open separate logins in the same window for years: https://addons.mozilla.org/firefox/addon/private-tab/

This is a great idea! I love the fact that I can have both contexts in the same window. What would also be pretty cool is being able to move all windows in one context into a new window, if I want to separate things in a new OS workspace.

This would be nice for using more than one Twitter account without needing to open one in private browsing (TweetDeck exists, and I do use it, but I prefer Twitter Web). I hope it makes it to the release channel.

There's a nice addon for Firefox, called Priv8: https://addons.mozilla.org/en-US/firefox/addon/priv8/

This is a Firefox addon that uses part of the security model of Firefox OS to create sandboxed tabs. Each sandbox is a completely separated world: it doesn't share cookies, storage, and a lots of other stuff with the rest of Firefox, but just with other tabs from the same sandbox.

This is really neat.

I became a huge fan of Opera Neon's interface, though. And it would be a perfect fit for "containers". Drop icons into folders, and done. Folders represent containers.

This is really good. I might actually find myself using FF more now. Chrome supports multiple profiles but it's quite tedious make the switch(you'd need to create multiple accounts). The best solution that I'd been using was opening an incognito session, regular session, guest session(easier than having multiple profiles but hardly sufficient when you want many more separate sessions).

Edit: I love the color coding feature that distinguishes the distinct containers you have open.

Lack of history separation seems quite pitty to me imo :-/

How would you design a user interface for container tabs that non-technical users can understand?

Something like container windows, isolating different browser windows instead of tabs, might be a clear way to visibly show the separation to the user. In one window, they can log into their work Gmail. In another window they can log into their personal Gmail without any Google cookie confusion.

I'm long searching for a solution to do this is a much broader way.. On the OS level.

Private Work A Work B Work C

Ideally it would seem like a different user. (Filesystem, cmd-tab). But easily accessible like the three finger swipe. Fast user switching doesn't cut it.

I even tried logging in on my local machine using VNC or remove desktop.. Is having 4 VMs the only way?

This is pretty awesome. Very useful.

My school's security is a joke. You cannot log out except by closing your browser. The session also never expires.

Not only that, but now they moved to a "single-sign on." If I sign in on one app, it signs me in for all apps.

Nice to see this integrated natively. I was using MultiFox before to get this functionality. For example, this allows me to manage multiple twitter accounts, without logging out and back in all the time.

Tech question: Does Firefox has technical process seperation of tabs nowdays? This is one of the main features of Chrome since 1.0 and just want to know if Firefox has something similar finally.

Slightly OT: This page reads like Mozilla's Developer Network (MDN) online documentation, I had to read the first sentences few times until I got what container tabs are about.

However, very nice feature.

It would be cool if there was a shortcut to hide all other tabs but a certain group.

I would love if I could use this to organize my 100 tabs I always have open.

I use the Qupzilla browser incognito mode which is a separate session per-window by default. It uses the Chrome guts and has a few rough edges.

the thing I blame is that ctrl+t on a container opens a new tab of the default container and not the one that is currently on focus.

Awesome. Coming up with legitimately innovative features and publicizing them will do more good than a dozen new logo campaigns.

Nice, up until now I used Chrome as the browser logged into everything (fb, Twitter, Google) and FF as the main browser.

Why do I even need this? Isn't it by default so that site1.com can't see cookies from site2.com for example?

Been wanting something like this for years.

A welcome development, though long overdue. I don't understand why browser UI is so boring and unimaginative.

An official linux container tab with shell access (for dev, emacs, etc) would be a killer feature for Chromebooks.

Anyone know when this feature is planned to hit Beta or Stable ?

another way to use chrome in a sandbox

https://blog.jessfraz.com/post/docker-containers-on-the-desk...

not needed if you're running Qubes-OS :)

As a user, I actually just want my browser to contain less features. Vendors add and add and add features. If I want different user profiles, I already have many users on my OS - I just switch between them.

When Chrome came out, I and many others switched to it just because it was lacking so many features. It was great!