App Sandbox Runner is a Linux alternative to Sandboxie-Plus for trying programs and scripts in disposable sandbox profiles and seeing exactly what they changed.

What it really does:

• Sandbox profiles with a private HOME, XDG config/cache/data/state dirs and TMPDIR under ~/AppSandboxes/<profile>, optionally seeded with copies of real-home files
• Scrubbed environment (allow-list) so tokens/secrets in your session do not leak
• Resource limits via setrlimit: CPU seconds, address space (memory), open files, file size, processes, plus a wall-clock timeout that kills the whole process group
• Landlock LSM file rules when the kernel supports them: writes allowed only inside the sandbox folder, optional mode that also hides the real home from reads
• Network block via a seccomp-BPF filter (only AF_UNIX sockets allowed), offered only when the probe shows the filter is really enforced
• Full file-change tracking (created / modified / deleted, SHA-256) against the baseline
• Recover a sandbox file to its real-home location (existing file is backed up first), delete selected files or wipe the whole sandbox
• Run history with exit status / signal, CPU time and peak memory from wait4(), live process tree and output console; capability probe that shows what your kernel allows

Honest limitations: this is NOT antivirus-grade isolation. There are no Linux namespaces (user namespaces and bubblewrap are blocked inside a strict snap), no kernel driver and no virtualisation. In "redirect only" mode a program can still write to absolute paths in your home. X11 programs can still see other X11 windows. Programs run inside this app's confinement (core22 runtime tools and executables / AppImages stored in your home folder). The snap "home" interface does not grant access to hidden files/folders directly in your home (e.g. ~/.bashrc, ~/.config), so such paths cannot be seeded into, or recovered from, a sandbox when installed as a snap.

Disclaimer: This project is an independent open-source tool and is not affiliated with, sponsored by, or endorsed by Sandboxie-Plus, David Xanatos or Sophos.

Support development: https://buymeacoffee.com/thanhnv128b