chroot &#x2F; firejail &#x2F; lxc &#x2F; ...<p>But usually I just prefer to run apps without a sandbox, and ensure they can&#x27;t touch anything important (new role + apparmor&#x2F;selinux&#x2F;grsec).