I've used [mbox][0], [firejail][1] for this case.

    mbox COMMAND

run COMMAND and shows you what files changed. Then you can select drop or commit those files.

    $ mbox mktemp
    /tmp/tmp.cfJElOQmNK
    Sandbox Root:
    > /tmp/sandbox-30749
    > F: /tmp/sandbox-30749/tmp/tmp.cfJElOQmNK
    F:/tmp/tmp.cfJElOQmNK
    [C]ommit all, [c]ommit, [i]gnore, [d]iff, [l]ist tree, [q]uit ?> q
    $


    firejail --private=/path/to/home-for-command COMMAND

does similar things. But it only sandbox $HOME. Also does not show what is changed by defult.

[0]: https://github.com/tsgates/mbox

[1]: https://firejail.wordpress.com/