on linux the following might work: - enter a user and mount namespace - mount a tmpfs, e.g. over /tmp - remount everything else as readonly altern

on linux the following might work: - enter a user and mount namespace - mount a tmpfs, e.g. over /tmp - remount everything else as readonly alternatively firejail --overlay-tmpfs <command>