Quick Alpine container with the current directory mounted as the current directory:

    docker run --rm -it -v $(pwd):/src -w /src alpine sh

Replace alpine with your favourite Linux distro or image.

Note entirely perfect, but will be enough against anyone not actively exploiting kernel privilege escalation bugs.

▲ zdragnar 6 hours ago | parent [-]

Neither podman nor docker will help you when the current directory is your home directory, though. It sounds like that's the root problem here- someone handed the keys to the kingdom to grok, and grok did what grok does, which is look at everything it can for context.

▲

lobo_tuerto 6 hours ago | parent [-]

That's why I went with a different strategy and scope: Copy the current Git repo into a sandboxes dir, mount that copy in the container. The tradeoff is disk space allocated per sandbox, but I'm OK with that.

	▲	backwardsponcho 4 hours ago \| parent [-]
		Wouldn't you solve the space allocation issue by using a symbolic link? Sorry if it's a dumb question - I'm just getting into sandboxing for the first time myself and ran into this same thought before.