Bubblewrap is a CLI interface for these, you know? It's been some time since bwrap recommended avoiding their SUID wrapper.