Can you please elaborate on the use of sudo -u nobody? Do you use it interactively? I’m intrigued.

Yea I do. I use it for programs where I’m unsure whether it will read or modify my filesystem. I still allow the program to run arbitrary computation and use the network. It’s just the filesystem part that I want to isolate.