Linux has seccomp and landlock, which are basically harder-to-use versions of pledge/unveil.