App Sandbox Runner

App Sandbox Runner is a Linux alternative to Sandboxie-Plus for trying programs and
scripts in disposable sandbox profiles and seeing exactly what they changed.

What it really does:
- Sandbox profiles with a private HOME, XDG config/cache/data/state dirs and TMPDIR
under ~/AppSandboxes/<profile>, optionally seeded with copies of real-home files
- Scrubbed environment (allow-list) so tokens/secrets in your session do not leak
- Resource limits via setrlimit: CPU seconds, address space (memory), open files,
file size, processes, plus a wall-clock timeout that kills the whole process group
- Landlock LSM file rules when the kernel supports them: writes allowed only inside
the sandbox folder, optional mode that also hides the real home from reads
- Network block via a seccomp-BPF filter (only AF_UNIX sockets allowed), offered only
when the probe shows the filter is really enforced
- Full file-change tracking (created / modified / deleted, SHA-256) against the baseline
- Recover a sandbox file to its real-home location (existing file is backed up first),
delete selected files or wipe the whole sandbox
- Run history with exit status / signal, CPU time and peak memory from wait4(), live
process tree and output console; capability probe that shows what your kernel allows

Honest limitations: this is NOT antivirus-grade isolation. There are no Linux
namespaces (user namespaces and bubblewrap are blocked inside a strict snap), no
kernel driver and no virtualisation. In "redirect only" mode a program can still
write to absolute paths in your home. X11 programs can still see other X11 windows.
Programs run inside this app's confinement (core22 runtime tools and executables /
AppImages stored in your home folder). The snap "home" interface does not grant
access to hidden files/folders directly in your home (e.g. ~/.bashrc, ~/.config), so
such paths cannot be seeded into, or recovered from, a sandbox when installed as a snap.

Disclaimer: This project is an independent open-source tool and is not affiliated
with, sponsored by, or endorsed by Sandboxie-Plus, David Xanatos or Sophos.

Support development: https://buymeacoffee.com/thanhnv128b