Run programs in a lightweight sandbox.
Run a program in a read-only environment
bwrap --ro-bind / / /bin/bash
Give the environment access to devices, process information and create a `tmpfs` for it
bwrap --dev-bind /dev /dev --proc /proc --ro-bind / / --tmpfs /tmp /bin/bash