In practice, mainstream distributions do not offer ready-to-use zero-conf sandboxing for userland applications. There are of course exceptions, like those usin

In practice, mainstream distributions do not offer ready-to-use zero-conf sandboxing for userland applications. There are of course exceptions, like those using Flatpak, but what I would like to see is Firejail/bwrap applied to all binaries, with sane defaults. In other words, if I run python or Firefox and they get compromised, they should not be able to read e.g. ~/.ssh and steal my private keys (unless I gave them permission to). Nix has done a great work making dependencies declarative and reproducible, I would also like clean sandboxing as it is an equally important issue.