bubblewrap (unprivileged sandboxing tool)

Many container runtimes focus on providing infrastructure for

system administrators and orchestration tools to run containers.

Bubblewrap provides container runtime for unprivileged users, which

reduces the surface area for privilege escalation.