SELinux's sandbox[1] tool works pretty well for isolating GUI applications (with -X). [1] https://linux.die.net/man/8/sandbox