sandboxing Wayland applications

I like sandboxing Linux applications. Tools like bubblewrap and Bubblejail make this easy, building on Linux namespaces . This works well for command line applications, but sandboxing graphical applications is harder. A graphical Wayland application needs to access the Wayland socket to handle its windows. The Wayland socket gives access to sensitive data like screen contents. You might want to…