Wonderful little tool, too bad you must chain various exec calling tools to get cgroups (a bit akin to `ionice ... nice ... cmd`) and Linux users namespaces can

Wonderful little tool, too bad you must chain various exec calling tools to get cgroups (a bit akin to `ionice ... nice ... cmd`) and Linux users namespaces can't allow UNIX sockets while preventing network access (I think?). Migrated from Firejail when its complexity annoyed me too much and I hit https://github.com/netblue30/firejail/issues/3001 https://github.com/netblue30/firejail/issues/3001 (Firejail doesn't like parens or brackets in --put/--get parameters) to a badly NIH version using bwrap and bash to have "profiles": https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap_auto https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap_aut... https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap_easy https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap_eas... PS: strace is your best friend when trying to make bwrap profiles