https://github.com/jrz/container-shell

It does something very simple, and it’s a POSIX shell script. Works on Linux and macOS. Uses docker to sandbox using bind mount

Yeah but it doesn't COW anything else, and Docker is a bit heavy for this.