Dedicate user account. That's not to say I don't use bwrap. But I use that specifically to run 'user-emulation' stories where an agent starts in their own `~/

Dedicate user account. That's not to say I don't use bwrap. But I use that specifically to run 'user-emulation' stories where an agent starts in their own `~/` environment with my tarball at ~/Downloads/app.tar.gz, and has to find its way through the docs / code / cli's and report on the experience.