I use pi and bubblewrap (bwrap) to offer some sandboxing. I call it `pise` for "pi secure environment". - https://codeberg.org/dannyfritz/dotfiles/src/commit/f5d082d2...