I have to applaud you for experimenting, it's the best way to learn. I'm glad you found and are using Firejail, it's a great little tool that not many know about and will certainly help in securing your apps, but it may not help if you're making general usage mistakes. It's interesting to see that you're using Subgraph OS too, which uses a sandboxing system called Oz, somewhat similar to Firejail. It's fundamentally flawed as users must declare beforehand which apps/programs they want to be sandboxed, it's implemented entirely in userspace and relies on a daemon. Both of these tools actually inspired my Master's thesis. I wanted a something that sandboxes processes with namespaces and seccomp automatically and couldn't be circumvented by taking down a daemon. So I took a Linux kernel with grsecurity and I modified the execve system call to sandbox all spawned processes. I then modified grsecurity's RBAC tool to allow whitelist system call and namespace policies to be applied. It was pretty much a proof of concept but it mostly worked.