Comment by jonahx

Proper and easy to use support for sandboxes at the OS level, or better yet capabilities, seems like the only long term solution.

Many things I run I want to limit to r/w a single dir, and to have to request permission to make network calls.