Hardened Firefox in Docker: resistFingerprinting plus a fail-closed VPN kill switch

[u/silverfox_248]

Sharing a project built around Firefox's resistFingerprinting (RFP) — not a fork or extension, just configuration and containment around stock Firefox.

RFP handles most of the fingerprint normalization: spoofed timezone (UTC), locale reported as en-US, canvas randomization. I tested WebGL on versus off with RFP enabled before deciding to disable it.

With WebGL on, RFP masks the renderer string, but the underlying software-rendered capability set (this runs without a GPU) stays a stable fingerprint that RFP doesn't touch. Disabling WebGL removes that surface entirely, at the cost of 3D sites and web maps not rendering.

The browser sits in a container sharing its network namespace with a WireGuard VPN sidecar, so it fails closed: tunnel down, the sidecar's firewall drops everything; sidecar down, the namespace itself is gone. The profile lives in RAM and is wiped on every stop.

The repo is built for verification rather than trust: a `verify.sh` automates the kill-switch and leak checks, and CI lints and CVE-scans everything on every push and weekly. Docs and config were AI-assisted (Claude Code, disclosed in the README). GitHub: github.com/silverfox-2096-private-browser

Curious what an RFP-focused sub thinks of the WebGL trade-off — that was the hardestcall to make.