Outline Tab Firefox only

Guide

Two logins on one site, two IPs if you want them

Ghost Browser sells that as a product. In Firefox you already have the cookie half. Outline gives you the network half if you run a server. They are not the same feature. Mix them up and you will think the VPN is broken when Gmail is still logged into the same account.

What Ghost Browser actually is

Ghost Browser is a Chromium fork. Its identities are separate cookie jars, color-coded. Cookies, localStorage, IndexedDB, and service workers are split per identity. That is how you stay logged into two Gmail accounts in one window. The default identity is the normal shared jar. Temporary identities die when you close their tabs. Permanent identities keep the jar.

Proxy is a second product on top, Ghost Proxy Control. It assigns HTTP, HTTPS, or SOCKS5 to a tab, an identity, or a workspace. Stock Chrome cannot do that. Ghost patched the browser. If you only assign proxies and leave everyone on the default identity, you still have one login. If you only split cookies and skip proxies, you have two logins on the same IP.

Cookie isolation in Firefox

Firefox calls these jars contextual identities. The UI is Multi-Account Containers, made by Mozilla. Each container has a cookieStoreId such as firefox-container-1. Cookies for mail.google.com in Work are not visible to Personal. LocalStorage and IndexedDB follow the same id in current Firefox.

This is not Firefox's default tracking protection. Total Cookie Protection partitions third-party cookies by the top-level site. Two tabs on facebook.com still share facebook.com cookies. Containers split first-party cookies too. That is the Ghost identity equivalent.

To use it:

  1. Install Multi-Account Containers from addons.mozilla.org.
  2. Open the Containers toolbar icon. Create Personal, Work, Client A, whatever names you need.
  3. File menu, or the icon, then New Container Tab, and pick the container.
  4. Log into the site in that tab. Open the same site in another container. You get a second login.

You cannot move a live tab into another container. The cookieStoreId is fixed at create time. Reopen the URL in the other container. Same limitation Ghost has when you open a tab into an identity.

Throwaway jars: the Temporary Containers add-on creates a new container per tab and deletes it when the tab closes. That matches Ghost's temporary identities. Separate Firefox profiles (about:profiles) isolate everything, including extensions. Use a profile when you want a wall, not a jar.

Outline Tab does not isolate cookies. Two tabs on different Outline keys still share Gmail if they share a container. Arming a tab changes the SOCKS path, not the cookie store. If you want Ghost-style multi-login, put each login in its own container, then arm that tab in Outline Tab with the matching key.

Bind the proxy with Outline Tab

Outline keys are Shadowsocks (ss://). Firefox cannot speak that. Outline Tab runs a local helper that turns each key into SOCKS5 on 127.0.0.1, then uses browser.proxy.onRequest so only the tabs you arm go through that listener. Chrome's proxy API is profile-wide. That is why this is Firefox only.

  1. Download Outline Tab, unzip it, run ./install.sh.
  2. In Firefox open about:debugging#/runtime/this-firefox, Load Temporary Add-on, pick extension/manifest.json.
  3. Click the toolbar icon. Paste an ss:// or ssconf:// key. Name it after the identity, for example Work.
  4. Open the site as a container tab for that identity. Flip the breaker. The orange group in the tab strip is that key's name.
  5. Add another key, name it, open a second container tab, select the second key in the dropdown, flip the breaker on that tab.

Unarmed tabs stay on your normal connection. Changing the dropdown on a live tab switches that tab's key. Removing a key disarms the tabs that used it. DNS for armed tabs goes through SOCKS (proxyDNS), so the hostname is not resolved on the LAN.

Do not also set a proxy inside Multi-Account Containers' Advanced settings. Let Outline Tab own the SOCKS path. Containers own the cookie jar. Two tools writing proxy config will fight.

Stand up your own Outline server

Outline is not a VPN you subscribe to. You run a Shadowsocks server and hand out access keys. The official path is Outline Manager from getoutline.org. It can provision a droplet, or you pick Set up Outline anywhere and it gives you a docker command for any Linux VPS.

After Manager talks to the server API you get a details page. The + control creates an access key. Each key is its own password. Share the ss:// string, or the invite link. Delete the key to revoke it. You can set a data cap per key.

All keys on one Outline server leave through that server's public IP. Two keys are two credentials, not two locations. If a site keys the session on IP, two containers on two keys from the same box still look like one address. For a second country, run a second Outline server in that region and issue a key from that Manager entry.

Do not turn on the Outline Client app on the same Mac if you want per-tab routing. The Client is a system tunnel. It grabs the whole machine. Paste the ss:// key into Outline Tab instead.

A static key looks like ss://METHOD:PASSWORD@HOST:PORT/?outline=1 with the userinfo often base64. Dynamic keys (ssconf://) fetch that JSON over HTTPS so you can rotate the backend without reprinting keys. Outline Tab accepts both.

A working Ghost-shaped setup

  1. Install Outline Manager. Create one server per exit IP you care about. Create one access key per identity.
  2. Install Multi-Account Containers. One container per identity, named to match the key.
  3. Install Outline Tab. Paste each access key, name it to match the container.
  4. Open the site as a container tab. Arm that tab with the matching key. Never reuse the default container for those accounts.
  5. Disable WebRTC if the IP must not leak. about:config, media.peerconnection.enabled = false. That is browser-wide. Meet will die. Details are in the FAQ.

What this will not do

Containers do not give you a new canvas, GPU, or font list. You are still one Firefox on one machine. Sites that fingerprint the device can still tie identities together. Ghost's anti-detect claims are a separate product surface. Do not treat this guide as that.

Service workers have historically leaked across containers in some Firefox versions. If a site behaves as if it knows both logins, try a temporary container or a separate profile before you blame the proxy.

Unsigned add-ons unload when Firefox quits. Load Outline Tab again from about:debugging after a restart. The helper and the containers stay.