pakai bubblewrap
misal waterfox
waterfox.sh
#!/bin/bash
PROFILE="$HOME/.waterfox"
CACHE="$HOME/.cache/waterfox"
DOWNLOADS="$HOME/Downloads"
XAUTH="${XAUTHORITY:-$HOME/.Xauthority}"
USER_ID="$(id -u)"
mkdir -p "$DOWNLOADS" "$PROFILE" "$CACHE"
exec bwrap \
--die-with-parent \
--new-session \
--cap-drop ALL \
--unshare-all \
--share-net \
\
--ro-bind /usr /usr \
--ro-bind /bin /bin \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
\
--dir /etc \
--ro-bind-try /etc/resolv.conf /etc/resolv.conf \
--ro-bind-try /etc/hosts /etc/hosts \
--ro-bind-try /etc/nsswitch.conf /etc/nsswitch.conf \
--ro-bind-try /etc/ssl /etc/ssl \
--ro-bind-try /etc/ca-certificates /etc/ca-certificates \
--ro-bind-try /etc/pki /etc/pki \
--ro-bind-try /etc/fonts /etc/fonts \
--ro-bind-try /etc/fontconfig /etc/fontconfig \
--ro-bind-try /etc/machine-id /etc/machine-id \
--ro-bind-try /etc/asound.conf /etc/asound.conf \
--ro-bind-try /etc/localtime /etc/localtime \
\
--dir /var \
--dir /var/lib \
--dir /var/lib/dbus \
--ro-bind-try /var/lib/dbus/machine-id /var/lib/dbus/machine-id \
--ro-bind-try /etc/machine-id /var/lib/dbus/machine-id \
\
--dir /sys \
--ro-bind-try /sys/dev/char /sys/dev/char \
--ro-bind-try /sys/devices /sys/devices \
\
--proc /proc \
\
--tmpfs /dev \
--dev-bind /dev/null /dev/null \
--dev-bind /dev/zero /dev/zero \
--dev-bind /dev/urandom /dev/urandom \
--dev-bind-try /dev/random /dev/random \
--dev-bind-try /dev/tty /dev/tty \
--dev-bind-try /dev/dri /dev/dri \
--tmpfs /dev/shm \
\
--tmpfs /tmp \
--tmpfs /run \
--dir "/run/user/$USER_ID" \
\
--dir /home \
--dir /home/devuan \
--tmpfs /home/devuan/.config \
--tmpfs /home/devuan/.local \
\
--bind "$PROFILE" /home/devuan/.waterfox \
--bind "$CACHE" /home/devuan/.cache/waterfox \
--bind "$DOWNLOADS" /home/devuan/Downloads \
\
--ro-bind-try "/run/user/$USER_ID/pulse" "/run/user/$USER_ID/pulse" \
--ro-bind-try "/run/user/$USER_ID/pipewire-0" "/run/user/$USER_ID/pipewire-0" \
\
--ro-bind "$XAUTH" /home/devuan/.Xauthority \
\
--setenv HOME /home/devuan \
--setenv DISPLAY "$DISPLAY" \
--setenv XAUTHORITY /home/devuan/.Xauthority \
--setenv NO_AT_BRIDGE 1 \
--setenv PULSE_SERVER "unix:/run/user/$USER_ID/pulse/native" \
--setenv XDG_RUNTIME_DIR "/run/user/$USER_ID" \
\
waterfox "$@"