@quad @lanodan
huh, TIL bwrap exists.
Is it basically like `unshare` that works without having root?
So you'd first switch to service-specific user, then run bwrap?
How would you start the service on boot? Have init switch user and call bwrap? Or the old ugly @reboot in user's crontab?
