[WhyNotHugo]

Quick Alpine container with the current directory mounted as the current directory:

    docker run --rm -it -v $(pwd):/src -w /src alpine sh

Replace alpine with your favourite Linux distro or image.

Note entirely perfect, but will be enough against anyone not actively exploiting kernel privilege escalation bugs.

[zdragnar]

Neither podman nor docker will help you when the current directory is your home directory, though. It sounds like that's the root problem here- someone handed the keys to the kingdom to grok, and grok did what grok does, which is look at everything it can for context.

[lobo_tuerto]

That's why I went with a different strategy and scope: Copy the current Git repo into a sandboxes dir, mount that copy in the container. The tradeoff is disk space allocated per sandbox, but I'm OK with that.

[backwardsponcho]

Wouldn't you solve the space allocation issue by using a symbolic link?

Sorry if it's a dumb question - I'm just getting into sandboxing for the first time myself and ran into this same thought before.

[lobo_tuerto]

I'm OK with the space being taken. I want total isolation, don't want changes in my main or sandboxes to ripple to one another. As for maintaining, it's only a `rm -rf ~/sandboxes/*` away anyway.