Hacker News Reader

Ooh, is this a good way to sandbox execs like ImageMagick or stuff like that?

Use firejail, it's a "one click" solution with prepackaged profiles.

It uses the same kernel knobs as systemd does, but is more user-friendly and has more features.

I use it for every application that handles data received from other machines: books, images, documents, whatever.

You can also use Bubblewrap, but getting it up and running requires a lot more fiddling around. For example, this is what I use to isolate Zoom from the rest of my system: https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6...

In my case I'm using Bubblewrap because Firejail was only used for Zoom, and this felt a bit of a waste considering Bubblewrap was already installed.