Hi again Neville, 
thanks a lot for your latest reply.
I see. Well, I have to admit it didn´t occur to me that using a VM might be the “culprit”. 
In actual fact I´m using KVM/qemu/virt-manager for Debian but the principle you referred to is certainly the same.
The background of it is that I (pretty long ago though) used to help a friend with teamviewer. Until now that´s the only programme which couldn´t be sandboxed by firejail .
This phenomenon was already dicussed here: Profile requests · Issue #825 · netblue30/firejail · GitHub
So as a workaround I installed teamviewer in a VM to get another form of “sandbox”.
Later we changed to anydesk and I installed it in a VM as well for “historical” reasons… 
In actual fact, yes, that would be possible. Especially in view of the fact that anydesk in contrast to teamviewer even has a profile of its own for the use with firejail:
ll /etc/firejail | grep anydesk
-rw-r--r-- 1 root root 655 Jul 11 2021 anydesk.profile
I would have preferred a VM though. But your proposition is certainly worth contemplating. Tnx again.
Seems nice. Glad you can report a success. 
No idea if it helps but did you try:
$mod+Shift+num ?
like
$mod+Shift+2 # for using workspace2, i.e. a new workspace
This should shift the new window (for the graph) to a newly created workspace.
Perhaps it´ll come out more favourably there 
Just a guess, don´t know if it will have the desired effect …
reference:
2.7. Moving windows to workspaces
To move a window to another workspace, simply press $mod+Shift+num where num is (like when switching workspaces) the number of the target workspace. Similarly to switching workspaces, the target workspace will be created if it does not yet exist.
from i3: i3 User’s Guide
Many greetings
Rosika 