Comment by Draiken

Bubblewrap plus some whitelisting of domains/sockets is all you need.

Docker is always a pain to use and this way I don't have to re-install everything a billion times for every different project.