[fsflover]

> in 2025 no easy way for me to run a program that, say, "can't touch the filesystem or network".

Qubes OS exists for more than 10 years already. My daily driver, can't recommend it enough.

[jazzyjackson]

Windows pro also has a sandbox that can disable filesystem and network access, but they wasted the opportunity by allowing only one sandbox process at a time.