For GUI applications, firejail might be easier to use. It too isolates applications from your system, but comes with a bunch of pre-configured profiles for many

For GUI applications, firejail might be easier to use. It too isolates applications from your system, but comes with a bunch of pre-configured profiles for many popular applications (including proprietary ones), thus requiring zero configuration. Some of its more interesting features (in addition to the obvious path/privilege restrictions): - putting the application into a separate network namespace with its own firewall rules/network interfaces (for example, you can force Firefox to work through a VPN connection only, or block incoming connections with your main firewall rules and allow them for a single application) - using a separate X server for each application (works pretty much transparently) - setting resource limits (network bandwidth, memory, CPU, I/O; although not as flexible as systemd limits, they can be combined) - running `sudo firecfg` once will create a bunch of symlinks for all applications installed on your system and supported by firejail. After that, those applications will run under a sandbox automatically. Or you can create them manually (I did it for the PDF reader and such). https://github.com/netblue30/firejail/ https://github.com/netblue30/firejail/