My practical approach is to have a microvm for firefox and a bubblewrap “jail” for a firefox instance that runs on the host. Of course, the config options mentioned here are good too.