[evand]

Sincerely curious why you think a squashfs of the app contents (without any additional operating system bits) running under seccomp and apparmor is a hack? What do you think is the ideal solution?