AppFS ( http://appfs.rkeene.org/ http://appfs.rkeene.org/ ) was created for this purpose. Everything is run as an unprivileged user because there is no install

AppFS ( http://appfs.rkeene.org/ http://appfs.rkeene.org/ ) was created for this purpose. Everything is run as an unprivileged user because there is no install phase. You just run the software and the parts it needs are fetched lazily/JIT. Also because it uses PKI end-to-end, you trust the publisher of the application (as in signed RPM/DEB) not the site/mirror you are fetching it from (as in curl|bash).