This is a really nice idea. The shebang-based approach makes it feel way more natural than wrapping everything in a separate command.
I like that it forces you to explicitly think about what a script actually needs (files, network, etc.). Most shell scripts run with way more access than they should.
Feels like a good middle ground between “no isolation” and heavier tools like bubblewrap or firejail.
I like that it forces you to explicitly think about what a script actually needs (files, network, etc.). Most shell scripts run with way more access than they should.
Feels like a good middle ground between “no isolation” and heavier tools like bubblewrap or firejail.