Another options is "nsjail". I landed on it having considered at firejail, apparmour, selinux, bubblewrap.
I'm very frustrated with firejail since I can't for example block execution in my home directory, with the exception of one subdirectory.
It just can't be done.