Comment by spoiler

Not a security expert, so I could be wrong.

I imagine stuff like AppArmor, Snap (or Craft? I forget) sandboxes, or Docker and LXCs help with this. Or do they not?