FreeBSD jails can absolute have just the application you want sandboxed (and its config, datafiles, and linked libraries, and the library loader), at work I have a couple jails like that. We also have jails that have a full os.<p>It&#x27;s not as obvious or well documented how to set it up this way, but it was maybe a couple days work, including my first rc script ever, and the script to assemble the jail in our environment (you could probably have a tar file with the contents of the jail, and just add the conf&#x2F;data files)