I do something like that. I have a separate minimal chroot directory with just Firefox installed and configured, and use systemd-nspawn to start a container. Th

I do something like that. I have a separate minimal chroot directory with just Firefox installed and configured, and use systemd-nspawn to start a container. The container is using a snapshot (btrfs) of the chroot directory, which gets deleted when I close the Firefox instance. I use this not as my main browser, but only when I can't avoid visiting "the wild web", meaning unknown or untrusted sites, or even sites that use too much javascript for me to feel safe allowing in my main browser.