im not on arch but the explanation is still valuable: https://wiki.archlinux.org/title/Systemd-nspawn
Washhouse0749
joined 1 year ago
There are systemd nspawn Containers, you could install debian, or whatever you fancy inside, they provode simmillar isolation to docker containers and you can even integrate them with gui.
Containerized apps will then only see the container folder
You could spawn their processes in a isolated network namespace, connected to a proxy via tun interface. You can then setup firewall rules on that interface to block all traffic, except the proxy an maybe your own dns - that should all be out of the users „reach“.
true enough, video acceleration is a bit harder / more expensive with an extra gpu, thats why i shyed away from suggesting vms