Using bubblewrap to sandbox applications in Linux

Summary

The objective is to show various flags used in bubblewrap, as well as to create a sandboxed environment using bubblewrap. Using a custom kernel (such as linux-hardened) is necessary, for we shall play around with namespaces. Additionally, we shall also explore primitive graphics using Xorg and Xephyr, but performance is limited. However, the blogpost shall not cover audio playback.

Note: I am using Arch Linux, so your configuration might vary.