Fireball

Firejail is a sandbox program for isolated execution of graphical, console and server applications, which minimizes the risk of compromising the main system when running untrustworthy or potentially vulnerable programs. 

The program is written in C, distributed under the GPLv2 license and can run on any GNU/Linux distribution with a kernel older than 3.0

☝?After startup, the program and all its child processes use separate representations of kernel resources, such as the network stack, process table, and mount points. Applications that depend on each other can be combined into one common sandbox. If desired, Firejail can also be used to launch Docker, LXC and OpenVZ containers.

Ready-made system call isolation profiles have been prepared for a large number of popular applications, including Firefox, Chromium, VLC and Transmission.