Literally any container runtime can do this for you. No one does it though because it's annoying as hell to upfront figure out what you want, and then be unable

Literally any container runtime can do this for you. No one does it though because it's annoying as hell to upfront figure out what you want, and then be unable to increase that list later. Like if I were to try and find a not annoying way to do this, it would be to snapshot and overlay mount my filesystem at process launch time, then give a heuristic warning at process termination about what was changed. But then we're still into basically SELinux territory which because of course there's upfront things we don't want to allow read access to - i.e. SSH keys. (don't know what the lesson here is other then "for the love of god could we get a standardized secrets filesystem and/or API or something". Looking at you Hashicorp Vault and ~/.vault-token).