One easy way to create such a situation is to use bwrap without --dev.