I&#x27;ve used [mbox][0], [firejail][1] for this case.<p><pre><code>    mbox COMMAND
</code></pre>
run COMMAND and shows you what files changed. Then you can select drop or commit those files.<p><pre><code>    $ mbox mktemp
    &#x2F;tmp&#x2F;tmp.cfJElOQmNK
    Sandbox Root:
    &gt; &#x2F;tmp&#x2F;sandbox-30749
    &gt; F: &#x2F;tmp&#x2F;sandbox-30749&#x2F;tmp&#x2F;tmp.cfJElOQmNK
    F:&#x2F;tmp&#x2F;tmp.cfJElOQmNK
    [C]ommit all, [c]ommit, [i]gnore, [d]iff, [l]ist tree, [q]uit ?&gt; q
    $


    firejail --private=&#x2F;path&#x2F;to&#x2F;home-for-command COMMAND
</code></pre>
does similar things. But it only sandbox $HOME. Also does not show what is changed by defult.<p>[0]: <a href="https:&#x2F;&#x2F;github.com&#x2F;tsgates&#x2F;mbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tsgates&#x2F;mbox</a><p>[1]: <a href="https:&#x2F;&#x2F;firejail.wordpress.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;firejail.wordpress.com&#x2F;</a>