[adolph]

Maybe Singularity?

https://sylabs.io/guides/3.5/admin-guide/configfiles.html

[kasey_junk]

Singularity is likely* less secure than default container runtimes.

*not a security person or an expert on singularity but it advertises that it doesn’t do file system or user isolation by default