Sandboxing Untrusted Apps on Android: Using Island, Shelter, and Work Profiles for Complete Isolation

Many essential modern applications represent significant privacy liabilities. Social networking clients, ride-hailing platforms, and regional banking applications frequently demand intrusive device permissions, continuously scan local Wi-Fi networks, and attempt to read contacts and clipboard contents. While Android runtime permissions allow users to deny location or camera access, they do not prevent applications from querying device identifiers, scanning installed app lists, or communicating across shared storage caches.

True isolation requires hardware-enforced operating system sandboxing. Android includes an enterprise-grade sandboxing framework originally engineered for corporate environments: the Work Profile (Managed Profile). Using open-source utilities like Shelter and Island, privacy-conscious power users can repurpose the Work Profile to quarantine untrusted applications into a completely isolated cryptographic container.

1. The Architecture of Android Multi-User and Work Profiles

Under the Linux kernel architecture that powers Android, the operating system supports multiple isolated users. The primary device owner operates under User 0. When enterprise organizations deploy smartphones, they utilize the Android Device Administration framework to create a distinct secondary profile: User 10 (or Managed Profile).

The Managed Profile is not merely a separate home screen folder. It is an independent operating environment governed by strict SELinux domain transitions and distinct encryption keys:

• Cryptographic Isolation: User 10 utilizes independent file-based encryption (FBE) keys. When the Work Profile is locked or paused, its cryptographic keys are evicted from memory, rendering all cached files completely unreadable to User 0.
• Isolated File System Partitions: Applications installed in the Work Profile have their own distinct /data/user/10 storage tree. An untrusted app in User 10 cannot see files, photos, or documents located in your personal /data/user/0 storage.
• Dedicated Contact and Media Databases: The Work Profile maintains independent contacts databases, call logs, calendar stores, and shared download directories.

2. Shelter vs Island: Open-Source Architecture Comparison

Two primary applications enable users to control the Work Profile without requiring an enterprise Mobile Device Management (MDM) server:

Shelter (100% Free and Open Source):

Developed by PeterCxy and distributed on F-Droid, Shelter is fully open-source software (GPLv3). Shelter registers itself as the local Device Owner or Profile Owner of the secondary profile. It prioritizes strict privacy, containing zero proprietary analytics, zero cloud dependencies, and advanced batch auto-freezing capabilities that place sandboxed apps into deep sleep when closed.

Island (By Oasis Feng):

Developed by the creator of Greenify, Island offers a slick visual interface and integrates with “God Mode” (Device Owner mode configured via ADB). Island provides advanced app cloning options, selective permission bridges, and seamless integration with Shizuku for silent background management.

3. Step-by-Step Setup: Initializing a Secure Work Sandbox

Setting up Shelter takes less than five minutes. Follow this deployment procedure:

1. Install Shelter from the official F-Droid repository.
2. Open Shelter and review the setup screen explaining the Profile Owner delegation.
3. Tap Continue. The Android system will launch a formal system setup wizard: “Set up your work profile”.
4. Accept the prompt. Android creates User 10 and assigns Shelter as the administrative Profile Owner.
5. Once initialization completes, you will see two tabs in your app drawer: Personal (User 0) and Work (User 10). Applications in the Work Profile display a distinctive briefcase badge over their app icon.
6. Open Shelter, select any privacy-invasive app from your Personal tab (such as TikTok, Facebook, or WhatsApp), and tap Clone to Shelter.
7. Once installed inside Shelter, uninstall the app from your Personal profile. The app now exists exclusively inside your quarantined sandbox.

4. What Work Profiles Isolate (And What They Do Not)

Understanding the exact security boundaries of the Work Profile ensures you do not develop a false sense of security:

Data Category	Isolation Status	Technical Boundary Details
Photos & Documents	100% Isolated	Apps in Work Profile cannot access personal photos or internal storage
Contacts & Address Book	100% Isolated	Work profile maintains a blank, isolated contacts database
Installed Apps List	100% Isolated	Apps in User 10 cannot see which applications are installed in User 0
Clipboard History	Partially Isolated	Can be configured to block cross-profile copy-paste in Shelter settings
Hardware Identifiers	Shared	SoC serial numbers, Wi-Fi MAC, and device model are shared across profiles

5. Auto-Freezing Apps and Shizuku Automation Workflows

The premier capability of Shelter is its Auto-Freeze engine. Invasive social apps run persistent background wake-locks, querying location data and executing push-notification analytics even when closed.

Shelter leverages the native Android DevicePolicyManager.setPackagesSuspended() API to freeze apps instantly:

• In Shelter, mark your untrusted apps with the Auto-Freeze tag.
• Configure Shelter to trigger auto-freeze when the screen turns off, or place a 1-tap “Freeze All” widget on your home screen.
• When suspended, apps are greyed out on your home screen. They cannot execute background code, consume zero RAM, register zero alarms, and drain zero battery until you tap the icon to unfreeze them.

6. Advanced ADB Configuration: Setting Up Island God Mode

While basic Profile Owner setup enables a sandboxed Work Profile, advanced users often want full system-wide control without rooting their handset. By configuring Island or Shelter as the primary Device Owner via Android Debug Bridge (ADB), you unlock God Mode. In this state, the manager application can freeze applications directly in the personal profile (User 0), silently install or remove apps without confirmation dialogs, and enforce device-wide network security policies.

To configure Device Owner mode via your computer:

# Ensure no corporate accounts or secondary profiles exist before running
adb shell dpm set-device-owner com.oasisfeng.island/.IslandDeviceAdminReceiver

Once activated, Island gains granular control over operating system processes, enabling instant 1-tap freezing of OEM bloatware and privacy-invasive system services that normally cannot be disabled in standard Android settings menus.

7. Managing Cross-Profile File Transfers and Storage Access

Because the Work Profile isolates storage volumes completely, moving photos, documents, or downloaded APK files between User 0 and User 10 requires intentional routing. Applications inside the Work Profile cannot see your personal download folder, preventing malicious software from exfiltrating personal gallery files.

To transfer files securely between profiles, Android relies on the native Storage Access Framework (SAF). When an app in the Work Profile requests a file, the system file picker allows you to select documents stored in the personal profile. The system grants a temporary cryptographic read-only URI token to the isolated app, keeping the underlying storage path completely hidden from the quarantined environment.

8. Combining Work Profiles with Dedicated VPN Tunnels

To achieve total network isolation, Android allows the Work Profile to utilize an independent Always-On VPN tunnel separate from your personal profile:

1. Install a privacy-focused VPN or DNS firewall (such as RethinkDNS, WireGuard, or Orbot) inside the Work Profile.
2. Navigate to Settings > Network > VPN inside the Work settings.
3. Configure the client as Always-on VPN and enable Block connections without VPN.
4. All outbound traffic originating from sandboxed apps is forced through an encrypted VPN tunnel or Tor network, while your personal browsing on User 0 routes directly through your standard Wi-Fi or cellular connection.

7. Frequently Asked Questions

Can I completely turn off the Work Profile when I am not using it?

Yes. Android provides a native “Pause Work Apps” toggle in the quick settings shade. Tapping this toggle instantly terminates all processes in User 10, evicts encryption keys, and silences all notifications until unpaused.

Does creating a Work Profile slow down phone performance?

No. The Work Profile is a native feature of the Linux kernel user management system. It introduces zero CPU overhead and does not emulate a virtual machine.

How do I delete the Work Profile if I no longer need it?

Open Shelter or Island settings and select “Destroy Work Profile”. Alternatively, go to Settings > Accounts > Work Profile and tap “Remove Work Profile” to delete User 10 and all quarantined data completely.