Comment by mcv

Isn't this already possible? Give it its own user account with write access to the project directory and either read access or no access outside it.