I want some functionality like Sandboxie on Windows.
That is, I want to run a program in a sandbox. The program doesn't detect the sandbox, and can read files from outside the sandbox usually. But when the program attempts to write files, the files are only written in the sandbox, not outside. And then, possibly outside the sandbox, I want some way to see only the files created inside the sandbox.
I read Installing Sandboxie on ubuntu but it doesn't seem to be what I want.
According to http://www.linux-magazine.com/Issues/2015/173/Firejail, Firejail has an overlay feature, but the files are destroyed when the program which creates them ends. Instead, I want to inspect these files.
It seems these overlay things are part of Linux since kernel 3.18, not sure if there is some way to use them to achieve what I want.
I have Lubuntu 16.04.1 with linux kernel 4.4.0-53-generic.