pwdjail Transparent $PWD-based sandboxer based on user-separation. See http://clemens.endorphin.org/2017/05/pwd-based-privilege-separation.html for an explanation.