combining the ptrace approach for logging with mount namespaces, snapshotting or overlayfs would probably be more consistent approach if the program actually tries to use the files.<p>just stubbing out the system calls sounds like it&#x27;ll quickly break down once the programs try to do something more complicated with the files.