Open-source project
mozilla/contain-facebook avatar
mozilla/contain-facebook

Facebook Container isolates Facebook in a Firefox container so it cannot follow you

Facebook Container isolates your Facebook activity from the rest of your web activity in order to prevent Facebook from tracking you outside of the Facebook website via third party cookies.

1,074 stars181 forksJavaScriptMPL-2.0

At a glance

What is it?
Mozilla's contain-facebook add-on keeps Facebook in its own Firefox container, so the identity you log in with there is not available to the Facebook scripts embedded in other sites. It is a small JavaScript add-on with a real test suite, and the readme is unusually honest about the features you lose and the tracking it cannot touch.
Who is it for?
Adopt Facebook Container if you use Facebook and want to stop its third party cookies from following you around the rest of the web, and you are willing to give up Like buttons and Facebook logins on other sites. Do not adopt it as a general privacy tool, because the readme states plainly that it does not stop other ad networks from linking your Facebook activity with your browsing, and it does nothing about the data Facebook already holds.
Can I use it commercially?
Yes, with conditions. MPL-2.0 is a weak copyleft licence: you can use it inside commercial and closed-source software, but if you distribute changes to its own files, you must publish those changes under the same licence.
Is it still maintained?
Yes. The repository last received commits 3 days ago.
What is it written in?
Mainly JavaScript, according to GitHub's language statistics.

Answers come from the project's GitHub data, last synced on October 23, 2026, and from our analysis. They are not legal advice.

Editorial analysis

The problem is one cookie and one identity

Facebook Container is an add-on you can install on Firefox to prevent Facebook from tracking your activity on other websites, so you can continue to use Facebook while protecting your privacy.

The mechanism is Firefox containers, and the add-on is a specialisation of that feature for one site. The description says it isolates your Facebook activity from the rest of your web activity in order to prevent Facebook from tracking you outside of the Facebook website via third party cookies.

That is a precise statement of the threat, and it is narrower than most privacy tooling claims. The problem is not that Facebook is watching you on facebook.com, where you have explicitly logged in. The problem is that the Facebook script embedded in half the internet carries a cookie which identifies you to Facebook, so your visits to unrelated sites end up in the same place as your Facebook identity.

A container fixes that by making the identity unavailable. You are logged into Facebook in the container, and the container is a separate cookie jar, so the embedded script on another site is running as a visitor rather than as you.

The project is Mozilla's, the licence is MPL-2.0, the primary language is JavaScript, and the author field in the package manifest names Luke Crouch. The last push was on 2026-08-12 and the most recent tagged release is 2.3.12 from 2025-03-03.

Installing it signs you out and deletes the cookies

The enabling section is three steps, and the first one has a consequence that surprises people.

Install Facebook Container from the add-ons site. This will log you out of Facebook and delete the cookies it has been using to track you. Then open Facebook and use it as you normally would, because Firefox will automatically switch to the Facebook Container tab for you. And if you click a link to a page outside of Facebook, or type another website in the address bar, Firefox will load them outside of the container.

The sign-out and the cookie deletion are not a side effect, they are the point. A cookie that already identifies you to Facebook on other sites is exactly the thing that has to go, and it cannot be removed while it is still in place. So the first run of this add-on is a visible change to your browsing, and it happens once.

The automatic tab switching is the part that makes it tolerable in daily use. Without it you would be switching containers yourself, and a privacy tool you have to remember to use is a privacy tool you will forget.

You can log in to Facebook within its container as usual, and from that point the behaviour is that Facebook will not be able to easily collect your browsing data and connect it to your Facebook identity. The word easily in that sentence is doing some work, and it is the reason the add-on is a container rather than a blocker.

What breaks, and it is not a small list

The section on how this affects Facebook's features is the most useful part of the readme, because the cost is stated before you install rather than discovered afterwards.

The add-on prevents Facebook from linking your activity on other websites to your Facebook identity, and therefore two things will not work.

Like buttons and embedded Facebook comments on other websites will not work, because you are logged into Facebook only in the container. And websites that allow you to create an account or log in using Facebook will generally not work properly.

Those are real losses. Social login is the one that bites hardest, because a site that offers only Facebook login is now a site you cannot use without signing out of the container, and a Like button is a small piece of the web that simply stops appearing.

The trade is a fair one, and the alternative is a boolean choice. Either Facebook can identify you across the web, or it cannot, and everything that depended on that identification stops working. What the add-on does is make the second option cheap by handling the container switching for you, so the cost is the feature loss rather than the effort.

For a person who barely uses Facebook, the loss is near zero and the gain is total. For a person whose accounts are all Facebook logins, the add-on is not usable as it stands, and the readme's answer to that is the last section.

What it does not protect you from

The readme has a section titled Will this protect me from Facebook completely?, and the answer is no, with the reasoning given.

The add-on does not prevent Facebook from mishandling the data it already has or from what it permitted others to obtain about you. Facebook still has access to everything that you do while you are on facebook.com or in the Facebook app, including your Facebook comments, photo uploads, likes, and any data you share with Facebook connected apps.

The second half is the one that surprises people. Other ad networks may try to link your Facebook activities with your regular browsing, and the add-on does nothing about that, because it only isolates Facebook.

The readme then lists what else you can do, and it is a sensible list rather than a vague gesture. Change your Facebook settings, use Private Browsing and Tracking Protection, block third party cookies, and use the Firefox Multi-Account Containers extension to further limit tracking.

That ordering matters. The add-on is one tool against one tracker, and the readme is explicit that it is not a general shield. A privacy tool that claims to protect you from everything is either lying or has a different business model, and this one is neither, which is a good reason to trust the part of it that does work.

Containers are a general mechanism, not a Facebook special case

The section on using containers for other websites points out that containers are not just for Facebook, and that you can use them to prevent websites from linking your identities across the web by installing the Firefox Multi-Account Containers extension.

That is the honest framing of the whole project. Facebook Container is a small, opinionated configuration of a platform feature, and the platform feature is the general one.

The difference between the two is worth being precise about, because it is the difference between a tool and a policy. Multi-Account Containers lets you decide which identities travel together and which do not, and it does not decide anything for you. Facebook Container makes one specific decision for you, correctly, and that decision is the one that is tedious to make by hand and easy to get wrong.

The readme also links the general containers documentation at the start, which is the tell that this add-on is built on a documented browser feature rather than on a private hack. That matters for the longevity question, because the mechanism survives the add-on.

The readme's final point, that containers are not just for Facebook, is also an invitation. If you install this and it works, the natural next step is installing Multi-Account Containers and applying the same reasoning to the other identities you carry around the web.

A small add-on with a real test suite

The package manifest is short and it describes a project with more engineering discipline than the size of the code suggests.

The dependencies are minimal. There is one runtime dependency, web-ext at 6.7.0, which is Mozilla's command line tool for running and building add-ons. Everything else is a development dependency, and the list tells the story of the test strategy. mocha is the runner, nyc the coverage tool, chai and sinon and sinon-chai the assertion and mocking libraries. psl is the public suffix list, used to recognise registrable domains, which is what you need to decide whether a site is a third party to Facebook. webextensions-jsdom and webextensions-geckodriver are for driving the extension in a simulated DOM and in a real browser.

The last of those is the important one. An add-on that changes tab routing and cookie behaviour cannot really be tested in a unit test, so the project drives an actual Firefox through geckodriver with a 60 second timeout on the functional tests.

The eslint configuration includes eslint-plugin-no-unsanitized, which is the plugin that flags unsafe uses of DOM APIs, and that is a sensible plugin to require in a project that injects content into pages.

There is also a Volta block pinning node at 16.14.1 and npm at 8.5.0, so a contributor gets the same toolchain as the maintainer without a version manager of their own.

Running it locally, and the CI shape

The Development section is two commands.

bash
npm install
./node_modules/.bin/web-ext run -s src/

web-ext run launches a Firefox with the add-on loaded from the src/ directory, so the loop is a normal browser session with your changes in it rather than a build step.

The Testing section names two commands.

bash
npm run test

or, for just the linter.

bash
npm run lint

The test script in the manifest is more than a unit test run. It is eslint over src and test, then the coverage run, then the functional run, and the functional script drives a real browser with a 60 second timeout, while the feature tests run against a simulated DOM. There is also a development mode for the functional tests that sets NODE_ENV through cross-env, and a watch mode for the feature tests.

The build is one script.

bash
npm run build

And the build script is npm test followed by web-ext build with the overwrite-destination flag, which means the artefact you ship is built only if the tests pass. The output is the add-on zip file in the web-ext-artifacts folder, and that zip is what gets submitted to the add-ons site.

The repository also carries a.travis.yml, which dates the continuous integration setup, and a docs/ directory, a test/ directory and a src/ directory with the extension sources.

Editorial conclusion

Adopt Facebook Container if you use Facebook and want to stop its third party cookies from following you around the rest of the web, and you are willing to give up Like buttons and Facebook logins on other sites. Do not adopt it as a general privacy tool, because the readme states plainly that it does not stop other ad networks from linking your Facebook activity with your browsing, and it does nothing about the data Facebook already holds. Verify first that you use Firefox, since the mechanism is Firefox containers, and that losing embedded comments and social logins on other sites is acceptable for the sites you actually use.

Frequently asked questions

What does the Facebook Container add-on do?

It keeps Facebook in a separate Firefox container so that Facebook cannot link your activity on other websites to your Facebook identity through third party cookies. You keep using Facebook as normal, in its own container, and everything else loads outside it.

What happens when I install Facebook Container?

It logs you out of Facebook and deletes the cookies Facebook has been using to track you, which is the point of the add-on rather than a side effect. After that, Firefox switches to the Facebook Container tab automatically whenever you visit Facebook.

What breaks when I use Facebook Container?

Like buttons and embedded Facebook comments on other websites will not work, and websites that allow you to create an account or log in using Facebook will generally not work properly, because you are logged into Facebook only inside the container.

Does Facebook Container protect me from Facebook completely?

No. It does not prevent Facebook from mishandling data it already has, and other ad networks may still try to link your Facebook activity with your regular browsing. The readme suggests changing your Facebook settings, using Private Browsing and Tracking Protection, blocking third party cookies, and using Multi-Account Containers as well.

How do I develop the add-on locally?

Run npm install and then ./node_modules/.bin/web-ext run -s src/ to launch Firefox with the add-on loaded from the source directory. The test script runs eslint, the coverage run and the functional tests, which drive a real browser through geckodriver.

How is the add-on packaged for release?

npm run build runs the test suite first and then web-ext build, producing the add-on zip file in the web-ext-artifacts folder, which is the artefact submitted to the add-ons site.

Official sources

  1. Issues
  2. License: MPL-2.0
  3. mozilla/contain-facebook on GitHub
  4. README
  5. Releases
Add this badge to your README

If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.

Add this badge to your README

markdown
[![Hysen Labs](https://hysenlabs.com/badge/mozilla-contain-facebook.svg)](https://hysenlabs.com/projects/mozilla-contain-facebook)

Was this useful?