Easy Sandboxing on Linux with Bubblewrap

In these turbulent times, one frequently needs to run some tooling in a sandbox. The goal is mainly to reduce the blast radius: make it so programs within the sandbox cannot damage the host system (e.g. delete or overwrite something unintended), but also, to a lesser extent, to hide most of the filesystem to avoid exfiltrating sensitive data. Recently, Bartosz Taudul (of Tracy fame) showed how to…