firejail, bubblewrap, direct chroot, sandbox-run ... all have been mentioned in this thread. There is a gazillion list of tools that can give someone analysis

firejail, bubblewrap, direct chroot, sandbox-run ... all have been mentioned in this thread. There is a gazillion list of tools that can give someone analysis paralysis. Here's my simple suggestion: all of your backend team already knows (or should) learn Docker for production deployments. So, why not rely on the same? It might not be the most efficient, but then dev machines are mostly underutilized anyway.