Base Idea
3 items
Bubblewrap
Filesystem isolation through mount namespaces, without requiring root.
LD-Preload Firewall
Blocking network access by interposing a shared library ahead of libc.
Timeout
Bounding wall-clock execution time from outside the supervised process.