bwrap — Run programs in a lightweight sandbox. More information: <https://manned.org/bwrap>.

Run a program in a read-only environment

bwrap --ro-bind / / {{/bin/bash}}

Give the environment access to devices, process information and create a `tmpfs` for it

bwrap --dev-bind /dev /dev --proc /proc --ro-bind / / --tmpfs /tmp {{/bin/bash}}