Firejail: Light, featureful and zero-dependency security sandbox for Linux
Sandboxing capabilities of operating systems is surprisingly bad. It's very strange to me that there isn't an idiot-proof user-space function call for "start a subprocess, limited to these files/directories, this port, this much drive space, this much CPU, and this much memory".Of course you can do all these things (on Linux at least), but it involves a dizzying array of technologies.