> these tools often use a setuid binary, which actually has more permissions than most users. These tools often drop privileges as soon as the program is exec

> these tools often use a setuid binary, which actually has more permissions than most users. These tools often drop privileges as soon as the program is executed, in firejail, there's also an option to disalble root entirely within a namespace.