If you have bubblewrap
installed, you can use its mechanisms to limit filesystem access.
Example1. You want wine to have access to ~/.wine
, ~/Downloads
, but nothing else. You may use this command then:
bwrap --dev-bind / / --tmpfs ~ --bind ~/.wine ~/.wine --bind ~/Downloads ~/Downloads --new-session wine ~/.wine/path-to-your-program
In the command above, we create a new namespace, bind the root /
, bind an in-memory filesystem to ~
, and bind two directories above the ~
. Any changes done outside of those 2 directories will go into tmpfs and will be lost once bubblewrap (and your program) exits.
Example2. You don't want complex hierarchies, you just want all wine-related stuff to live in ~/.bubblewrap-wine-container
. And nowhere else. In this case, you can use:
bwrap --dev-bind / / --bind ~/.bubblewrap-wine-container ~ --new-session wine path-to-your-program-relative-to-this-directory
If you want to forbid internet access for any of those examples, add --unshare-net
argument. Or maybe even --unshare-all
to see if it'll launch. Refer to bubblewrap documentation for further details.