Dangerzone is a document sanitization tool that converts potentially malicious PDFs, office documents, and images into safe PDFs by stripping out embedded code and macros.
The tool addresses the risk of opening untrusted documents by using a sandbox-based approach. It converts input documents to PDF format if needed, then renders each page to raw pixel data within an isolated container. This pixel data is then reassembled into a new PDF outside the sandbox, eliminating any executable content while preserving the visual appearance of the document. The sandboxes use gVisor, an application kernel that implements Linux system calls without network access, preventing any compromised sandbox from communicating with external systems.
Dangerzone suits users who regularly receive documents from untrusted sources, such as journalists, security researchers, or anyone handling sensitive email attachments. It supports a wide range of input formats including Microsoft Office files, OpenDocument formats, EPUB, and common image formats. The tool runs on macOS, Windows, Linux distributions including Ubuntu, Debian, and Fedora, as well as specialized systems like Qubes OS and Tails. Optional OCR functionality restores text searchability in the output PDF, and file compression reduces the size of converted documents. The tool was inspired by Qubes trusted PDF but extends that concept to non-Qubes operating systems by using Podman containers instead of virtual machines.
The project receives issue reports from both core maintainers and external users, indicating real-world adoption without creating an unsustainable support burden. Maintainers typically respond to new issues and pull requests within a few days. Work in the issue tracker centers on bug fixes, feature enhancements, and user requests.
