Run Google Chrome with restricted access to $HOME

sandboxed-chrome.sh

#!/bin/sh

# This runs Google Chrome in a sandboxed environment with
# only restricted access to $HOME
#
# Requires bubblewrap https://github.com/projectatomic/bubblewrap
#
# TODO: Create a minimal /dev

exec bwrap --ro-bind / / \
           --tmpfs /tmp \
           --dev-bind /dev /dev \
           --proc /proc \
           --bind /run/user/$(id -u) /run/user/$(id -u) \
           --tmpfs /home \
           --bind $HOME/Downloads $HOME/Downloads \
           --bind $HOME/.config/google-chrome $HOME/.config/google-chrome \
           --unshare-pid \
           --new-session \
           /opt/google/chrome/chrome --no-sandbox