[acka]

Firejail[1] is IMO a good alternative. It handles sandboxing using Linux namespaces and seccomp-bpf.

[1] https://firejail.wordpress.com/