HN Debrief

Firefox Containers Preview

  • Privacy
  • Browser
  • Developer Tools
  • Open Source

Mozilla announced that Firefox Containers, long known through the official Multi-Account Containers extension, is coming to Firefox as a native feature. Containers let you keep separate cookie jars and sessions inside the same browser window, so you can stay logged into multiple Google or Microsoft accounts at once, isolate sites like Facebook or banks, and test web apps as different users without juggling browsers or repeated logins. The catch is that this is less a brand-new capability than a product decision to expose an old one. Several people pointed out that Firefox has shipped the underlying container system and even a hidden management UI for years behind about:config flags. What changes now is default visibility and onboarding, not the isolation model itself.

If your team uses Firefox for multi-account workflows or privacy isolation, expect the core feature to become easier to deploy but not yet feature-complete enough to replace the existing extension stack. Audit any dependence on site-to-container rules, sync, per-container proxies, or temporary containers before telling people to uninstall anything.

Discussion mood

Mostly positive, with a strong undercurrent of frustration. People like containers and see them as one of Firefox’s few genuinely differentiated features, but many felt the post oversold a long-existing capability and still leaves out the automation, routing, sync, and proxy features that make containers indispensable in real workflows.

Key insights

  1. 01

    Profiles and containers solve different problems

    They are not substitutes. Containers keep isolated sessions inside one browser window, which makes tab-level switching fast and preserves shared bookmarks, history, and extensions. Profiles create a much harder boundary with separate settings and add-on state, which is better for work versus personal or any setup where the browser itself needs to behave differently. That distinction matters because a lot of confusion around the feature comes from expecting containers to replace profile-level isolation, which they never will.

    Pick containers when you need fast parallel logins or lightweight privacy walls inside one workflow. Pick profiles when extension state, default browser routing, or stronger visual separation matters, and expect many teams to need both.

      Attribution:
    • WorldMaker #1
    • em-bee #1
    • ars #1
    • temporallobe #1
    • dolmen #1
  2. 02

    Per-container network routing is a power feature

    For many heavy users, containers are not mainly about cookies. They are a clean way to bind specific tabs to specific proxies, VPN paths, home networks, or internal jump-host-only environments. People described using Container Proxy, SOCKS5, and wireproxy with WireGuard to send only banking, streaming, or internal tooling traffic through a special route while leaving the rest of browsing alone. That turns containers into a practical network segmentation tool, not just an account switcher.

    If your organization relies on split tunneling, internal web tools, or geography-sensitive services, watch Mozilla’s proxy story closely before standardizing on the native UI alone. The missing per-container routing pieces are where containers become infrastructure, not just convenience.

      Attribution:
    • lxgr #1
    • svl7 #1 #2
    • nbaksalyar #1
    • DaSHacka #1
  3. 03

    Automatic isolation collides with real-world auth flows

    The dream setup is one container per site by default, but modern authentication breaks that fast. Cross-domain sign-in flows like OAuth and single sign-on often bounce between an app and an identity provider, and container boundaries can cause authorization mismatches if those hops land in different isolated contexts. People pointed to tools like uMatrix-style whitelisting as one way to manage the mess, but the core point stands: strict per-site isolation needs exceptions or it degrades usability badly.

    Do not assume you can flip on universal per-site isolation without breaking login flows. If you deploy containers as a privacy control, map your OAuth and single sign-on paths first and define exceptions deliberately.

      Attribution:
    • QGQBGdeZREunxLe #1
    • asdewqqwer #1
    • weberer #1
  4. 04

    This is mostly a default-on rollout

    The announcement reads like a new feature launch, but longtime users noted that the underlying container system and even the preferences UI have been sitting in Firefox for years behind privacy.userContext flags. The built-in feature is real, but the novelty is mostly discoverability and support, not a fresh technical capability. That explains why some users thought they had already been using native containers all along, because they had.

    Treat this as a packaging and productization change. It lowers adoption friction, which is valuable, but it should not be mistaken for a major new browser isolation primitive.

      Attribution:
    • Izkata #1 #2 #3
    • prmoustache #1
    • aniviacat #1
  5. 05

    Containers help privacy but do not stop fingerprinting

    Isolation works well for cookies and sessions, which is enough to prevent a lot of straightforward tracking and identity leakage between tabs. It does not stop a site from correlating visits across containers with network and browser characteristics such as IP address, user agent, screen size, or GPU details. Several comments pushed back on using containers as a complete privacy answer and framed them instead as a practical reduction in routine tracking exposure.

    Use containers to reduce account bleed and cookie-based tracking, but do not position them internally as anonymity protection. If fingerprinting resistance matters, pair containers with stronger controls or a browser built for that threat model.

      Attribution:
    • WorldMaker #1
    • cyphar #1
    • yjftsjthsd-h #1
    • wtfHN26 #1

Against the grain

  1. 01

    The privacy pitch is overstated

    The harshest pushback said Mozilla is dressing up a weak privacy control while still exposing enough browser and hardware information for trackers to identify users anyway. The tone was extreme, but it sharpened a real limit in the feature: containers are not a meaningful answer to pervasive fingerprinting or broader trust concerns about browser telemetry and partnerships.

    If you are choosing a browser on privacy grounds, do not let containers end the evaluation. Review the full data exposure surface, not just cookie isolation.

      Attribution:
    • lolcw #1
  2. 02

    Microsoft 365 still drives people back to Chromium

    For users buried in multiple Microsoft 365 organizations, containers sound ideal on paper but still fail in the messy parts of the workflow, especially Teams org switching. That leaves people falling back to Chrome or Edge despite preferring Firefox’s model. It is a reminder that the value of isolation features depends on brittle enterprise web apps actually tolerating them.

    Test your most painful SaaS flows, especially Microsoft identity and collaboration tools, before betting on containers as a support win. Browser isolation features are only as useful as the sites that cooperate with them.

      Attribution:
    • teekert #1

In plain english

about:config ↩
Firefox’s advanced internal settings page where hidden or experimental preferences can be turned on or off.
Container Proxy ↩
A Firefox extension that assigns different proxy settings to different containers.
Google Workspace ↩
Google’s business productivity suite, including services like Gmail, Drive, and account management for organizations.
GPU ↩
Graphics Processing Unit, a processor specialized for drawing images and 3D graphics.
Microsoft 365 ↩
Microsoft’s subscription productivity suite, including Outlook, Teams, and organization-managed accounts.
Multi-Account Containers ↩
A Mozilla Firefox feature and extension that lets different tabs keep separate cookies and login sessions so you can use multiple identities in one browser.
OAuth ↩
An authorization standard that lets one website or app sign you in or gain limited access through another identity provider like Google.
proxy ↩
An intermediate server that handles network requests on behalf of your browser or app.
Sidebery ↩
A Firefox extension for managing tabs, panels, and containers, often used with vertical tab layouts.
Teams ↩
Microsoft Teams, a chat and collaboration app that is part of Microsoft 365.
Temporary Containers ↩
A Firefox extension that creates disposable containers, often one per site or browsing session, to reduce persistent tracking state.
uMatrix ↩
A browser extension for controlling which domains and resource types a page is allowed to load.
user agent ↩
A browser identifier string that websites can read to learn what browser and operating system you are using.
VPN ↩
Virtual Private Network, a secure network connection that lets devices communicate as if they were on the same private network.
WireGuard ↩
A modern VPN protocol and software used to create encrypted private network connections.
wireproxy ↩
A tool that exposes a WireGuard tunnel as a local proxy that apps can use.

Reference links

Mozilla docs and product pages

Other browsers with similar features

Firefox extensions and companion tools

  • Sidebery
    Mentioned for container rules, panels, and vertical-tab workflows
  • Simple Tab Groups
    Suggested for users who want workspace-like tab organization
  • wireproxy
    Used to bind WireGuard tunnels to per-container proxy setups

Routing links to specific browser instances

  • Browser Tamer
    Suggested for routing links from apps to specific browser instances or profiles
  • Browsers
    Suggested as another tool for directing links into selected browser contexts
  • Switchyard
    Suggested for managing which browser instance opens which links

Historical references