diff --git a/host/main.cpp b/host/main.cpp
--- a/host/main.cpp
+++ b/host/main.cpp
@@ -21,6 +21,9 @@
     THE SOFTWARE.
 */
 
+#include <sys/resource.h>
+#include <unistd.h>
+
 #include <QApplication>
 #include <QDBusConnection>
 #include <QDebug>
@@ -56,6 +59,17 @@
 
 int main(int argc, char *argv[])
 {
+    // Firefox does not use O_CLOEXEC so we inherit tons of open FDs pointing
+    // to files and sockets. The latter causes pbi to appear to make requests
+    // to the outside, although it doesn't do that: https://bugs.kde.org/show_bug.cgi?id=399449
+
+    struct rlimit maxfd;
+    if (getrlimit(RLIMIT_NOFILE, &maxfd) == 0) {
+        for (int fd = 3; fd < (int) maxfd.rlim_cur; ++fd) {
+            close(fd);
+        }
+    }
+
     qInstallMessageHandler(msgHandler);
 
     // otherwise when logging out, session manager will ask the host to quit