[BoingBoomTschak]

IM is easy to sandbox (I myself have a bwrap profile for it) and GM is abandonware; it's basically ffmpeg vs libav. VIPS is where it's at if you want to know about the future.