🧊 Disposify

Open-source disposable browser, running entirely inside isolated Docker containers.
Safely open any website in a fully sandboxed environment — nothing touches your real system.

---

🧩 About

Disposify provides a disposable browser session that runs in a secure, ephemeral Docker container.
It launches a Firefox ESR instance within an Xvfb virtual display, streamed via noVNC — all without exposing your local environment.

Originally, this project started as SquareX-Open — the open-source version of SquareX.
Now, each major component is being released independently.
Disposify is the first — focusing on the disposable browser.

---

🚀 Features

• 🔒 Disposable Browser — launches instantly via noVNC
• 🧹 Ephemeral Sessions — everything is wiped when the container stops
• 🐳 One-Command Deploy — simple setup with Docker & Docker Compose
• 🧱 Hardened by Default —
  read_only rootfs, cap_drop: ALL, no-new-privileges, and tmpfs for writable data
• ⚙️ Secure Firefox ESR — runs in headless mode via Xvfb, served through noVNC + websockify
• 🧍 Non-Root Execution — runs Firefox as an unprivileged user
• 🚫 Zero Persistence — no data or configuration is retained between sessions

---

🧰 Quickstart

1️⃣ Clone the repository

git clone https://github.com/codeterrayt/Disposify.git
cd Disposify

2️⃣ Build and start (in background)

docker compose up --build -d

3️⃣ Open the disposable browser

Visit: 👉 http://localhost:6080

4️⃣ Stop and clean up

docker compose down

---

⚙️ How It Works

Disposify spins up an ephemeral Firefox browser inside an isolated Docker container. Each session runs in memory using tmpfs, ensuring nothing persists after shutdown.

Perfect for:

• 🧪 Visiting untrusted or suspicious websites safely
• 🔍 Testing browser behavior in a sandbox
• 🧊 Using a fully throwaway browser that leaves zero traces

---

🔐 Security Highlights

• Runs as non-root user (firefox)
• Uses read-only root filesystem
• All writable paths mounted as tmpfs (RAM-based)
• All Linux capabilities dropped
• No-new-privileges enforced
• Network and file isolation via Docker

---

☁️ Anonymity & Cloud Deployment (What it does — and what it doesn't)

Short summary: You can push Disposify’s Docker image to a cloud registry (for example AWS ECR, Google Container Registry, Docker Hub, or any other) and run the container on a cloud VM or container service in a chosen region. The browser session then originates from the cloud host’s public IP — not your local machine — which can make your activity appear to come from that cloud region. This is useful for isolating your local network from the browsing session and for running a session from a different geographical region without a VPN.

How this helps

• Hides your local IP: When the container runs on a cloud VM/container instance, outbound connections will use the cloud provider's public IP address(es), not your home/work IP.
• Region switching: Deploying the container in a different cloud region routes traffic through that region’s network, which can allow access to region-restricted content (subject to provider rules and local law).
• No client-side VPN required: End users only need to access the web UI (noVNC) served by the cloud host; the browser itself runs on the cloud instance.

Typical (high-level) workflow

1. Build the image locally:

   docker build -t disposify:latest .

2. Tag & push to your registry (example: Docker Hub or ECR):

   docker tag disposify:latest your-registry/your-repo/disposify:latest
   docker push your-registry/your-repo/disposify:latest

   (AWS ECR requires authentication and an ECR repository — follow your provider’s docs for registry login and push commands.)

3. Run the container on a cloud VM or container service (example):

   • On a VM:

     docker run --rm -d -p 80:6080 your-registry/your-repo/disposify:latest

   • On a container service: deploy the image to a container runtime (ECS, Fargate, GKE, etc.) and expose the noVNC port via an HTTP(s) load balancer or proxy.

4. Open the public URL / load balancer IP in your local browser to access the noVNC UI — the browser session runs remotely.

Important caveats & limitations

• Not perfect anonymity: Cloud providers log actions. The cloud provider and any intermediate infrastructure can observe metadata and traffic; this is not equivalent to full anonymity provided by privacy networks like Tor.
• Provider Terms & Monitoring: Cloud providers may block or throttle certain traffic, enforce Acceptable Use Policies, or terminate accounts for abuse.
• Data persistence risk: If you misconfigure volumes or storage, data may persist. Disposify’s defaults are ephemeral — keep it that way if you want disposable sessions.
• HTTPS / Encryption: Exposing noVNC publicly without TLS is not recommended. Use a secure reverse proxy (with TLS) or SSH tunnelling when exposing to the internet.
• Costs: Running cloud instances and traffic egress may incur charges.
• Not a guarantee to bypass law or policy: Using a cloud provider’s IP to access content does not make illegal actions legal. You are responsible for complying with local laws, the destination site’s terms, and your cloud provider’s Terms of Service.

Legal & ethical notice (please read)

Using remote cloud hosts to route traffic can have legitimate uses (privacy, testing, geo-specific testing). However, intentionally evading laws, committing fraud, or accessing content that is illegal in your jurisdiction is prohibited and risky. Do not use Disposify to facilitate unlawful activity. Respect site terms, copyright law, and local regulations.

---

🧠 Future Components

This is part of a modular open-source release series derived from SquareX-Open:

• 🧊 Disposify — Disposable Browser (current)
• 🔍 FileSan — Disposable File Viewer (coming soon)
• 🧰 Vaultify — Secure Environment Manager (coming soon)

---

🏗️ Tech Stack

• Docker / Docker Compose
• Firefox ESR
• Xvfb
• Fluxbox
• noVNC + websockify
• Alpine Linux base image

---

🤝 Contributing

Contributions are welcome! If you’d like to improve Disposify or add new disposable tools, open a PR or start a discussion.

---

📜 License

Licensed under the MIT License — see the LICENSE file for details.