Here it comes: https://paste.ee/p/voTFI
Note that I'm no Bash expert, and you'll undoubtedly find ways to improve or fix it. Usage:
- Run stuff in a sandbox
isolate bash- and then verify your access to filesystem is restricted - Enable Xorg for apps that need it
X=1 isolate mindustry- Wayland, which naturally isolates apps from each other, is enabled by default.
- Enable network for apps that need it:
NET=1 isolate curl https://ip6.me/api/ - Enter the sandbox to mess around with it manually:
NAME=mindustry isolate bash- Note that it doesn't catch Ctrl-C. Ctrl-C kills the isolated Bash.
- Populate data (installers and whatnot):
NAME=mygame isolate ls; cp installer.sh ~/.local/share/bubblewrap/mygame/; NAME=mygame isolate bash