Docker containers on the desktop
This is not sandboxing. Quite the opposite, this gives the apps root access:First of all, X11 is completely unsecure, the "sandboxed" app has full access to every other X11 client. Thus, its very easy to write a simple X app that looks for say a terminal window and injects key events (say using Xtest extension) in it to type whatever it wants. Here is another example that sniffs the key events, including when you unlock the lock screen: https://github.com/magcius/keylogSecondly, if you have docker access you have root access. You can easily run something like:docker run -v /:/tmp ubuntu rm -rf /tmp/*Which will remove all the files on your system.