As an alternative to bubblewrap, GNU Guix can also be used for
sandboxing.  It doesn't take much to get it to work and after the
package profile has been prepared it is just as quick as bwrap: