vmikk

sbx() {
  : '
  sbx - run a command in a minimal bubblewrap sandbox

  Overview:
    - Only the current working directory has read-write permissions and allows persistent changes
    - Host filesystem mounted read-only
    - /proc and /dev are also sandboxed
    - Existing PATH/env are kept, so system + conda tools work normally