You can trivially sandbox your Steam installation with pretty much zero performance overhead, if you install it through Flatpak. Using an app like Flatseal, you can then configure Steam to only have access to a designated drive with next to no further contact to your PC. You can individually disable access to networking, audio, D-Bus, USB devices, Bluetooth, shared memory and even the GPU itself if you're really freaked out. No command line needed.

That being said, I just run Steam natively on NixOS and have never seen any issues. The biggest RCEs I'm worried about are Ring 0 anticheat nuking my desktop like CloudStrike.

▲

chrneu 4 days ago | parent [-]

>Steam installation with pretty much zero performance overhead, if you install it through Flatpak.

In reality that isn't true. Flatpak steam runs like poo for a lot of people. Really, flatpak should be avoided if there are other installation methods, in general.

	▲	WD-42 4 days ago \| parent [-]
		Flatpak works fine for me on Arch. I use it mainly to avoid needing 32bit libs installed. Once steam goes 64 I’ll go native.