A secure Tor Browser setup example: Firejail version 0.9.68, Debian 11. It should work the same on any other Linux distribution. The steps are as follows:

1. Download Tor Browser from https://torproject.org

2. Assuming the archive was downloaded in ~/Downloads directory, extract the files:

$ cd ~
$ tar -xvf Downloads/tor-browser-linux64-X.Y.Z.tar.xz

3. Find the name of your Ethernet interface:

$ ip addr show

4. Create a desktop starter in ~/Desktop directory:

$ cat ~/Desktop/tor.desktop
[Desktop Entry]
Name=tor
Icon=/home/USERNAME/tor-browser_en-US/Browser/browser/chrome/icons/default/default128.png
Terminal=false
Type=Application
Exec=firejail --name=tor --private=~/tor-browser_en-US --net=INTERFACE ./start-tor-browser.desktop

Replace USERNAME with your user name, and INTERFACE with the name of your Ethernet interface you found on step 3.

5. Start the browser by clicking the tor icon on your desktop. This is the default setup, also available for older Firejail versions.

6. Optionally, lock down your network by adding --netlock on your exec line in the starter.

Firejail is the best option for sandboxing browsers and advanced privacy tools such as Tor. We depend largely on community members to help us push this technology further. Join us at https://github.com/netblue30/firejail