Change:
firejail bash ... Error: cannot establish communication with the parent, exiting... ... [milan ~]$ firejail --debug bash ~ Autoselecting /nix/store/fibk8jc2iwswn1q1d7aw98pcw2l3lzjf-bash-4.4-p12/bin/bash as shell Command name #bash# Attempting to find default.profile... Found default profile in /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail directory Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/default.profile Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Note: you can use --noprofile to disable default.profile DISPLAY :0, 0 Using the local network stack Parent pid , child pid Initializing child process Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Create the new utmp file Mount the new utmp file Cleaning /home directory Sanitizing /etc/passwd, UIDMIN 1000 Sanitizing /etc/group, GIDMIN 1000 Disable /run/firejail/network Disable /run/firejail/bandwidth Disable /run/firejail/name Disable /run/firejail/x11 Remounting /proc and /proc/sys filesystems Remounting /sys directory Disable /sys/firmware Disable /sys/hypervisor Disable /sys/module Disable /sys/power Disable /sys/kernel/debug Disable /sys/kernel/vmcoreinfo Disable /proc/sys/fs/binfmtmisc Disable /proc/sys/kernel/corepattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/vm/paniconoom Disable /proc/irq Disable /proc/bus Disable Disable /proc/timerlist Disable /proc/timerstats Disable /proc/kcore Disable /proc/kallsyms Disable /boot Disable /dev/port Disable /dev/kmsg Disable /proc/kmsg Disable /home/milan/.gnuplothistory Disable /home/milan/.zshhistory Disable /home/milan/.bashhistory Mounting read-only Disable Error: cannot establish communication with the parent, exiting... [milan ~]$ System: (NixOS: , Ubuntu/Fedora: , ...) (Hummingbird) Nix version: (run ) nix-env (Nix) 1.11.8 Nixpkgs version: (run ) ""
May be caused by . Does the same occur with , and not with ?
I'm having the same issue on Nixos 17.03. There at least it is exactly as you have described it, hence almost certainly the referenced issue.
Failure: [milan nixpkgs]$ firejail --noprofile -- firefox /etc/nixos/nixpkgs Parent pid , child pid Error: invalid whitelist path Error: cannot establish communication with the parent, exiting... Success: [milan nixpkgs]$ firejail --noprofile firefox /etc/nixos/nixpkgs Parent pid , child pid Child process initialized
Yep, that does look like it's that issue.

Discussion:
s = # Generated upstream information rec { baseName="firejail"; <del> version="0.9.44.10"; </del> <ins> version="0.9.48"; </ins> name="${baseName}-${version}"; <del> hash="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; url="https://netix.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.44.10.tar.xz"; sha256="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; </del> <ins> hash="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.48.tar.xz"; sha256="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; </ins> }; buildInputs = [ which

name = "${s.name}.tar.bz2"; }; <ins> prePatch = '' # Allow whitelisting ~/.nix-profile substituteInPlace etc/firejail.config --replace  '# follow-symlink-as-user yes'  'follow-symlink-as-user no' ''; </ins> preConfigure = '' sed -e 's@/bin/bash@${stdenv.shell}@g' -i $( grep -lr /bin/bash .) sed -e "s@/bin/cp@$(which cp)@g" -i $( grep -lr /bin/cp .)