if you install firejail then it behaves as bad as the newer things you describe (that is, most programs are started by a symlink to firejail which then starts t

if you install firejail then it behaves as bad as the newer things you describe (that is, most programs are started by a symlink to firejail which then starts that program in a restricted env... namespace, cap drop, apparmor, etc... but it's finicky and easy to bypass by user even by mistake, again, just like the alternatives you list) Linux still requires you to read. arch have the best non condescending docs.