Comment by anuramat

I can highly recommend bubblewrap for sandboxing -- configuration is just CLI arguments, one per a mounted path; I use a little script that mounts CWD, claude stuff, and XDG data directories in RW, and the rest in RO.

To me it seems like the only reason to fiddle with docker is if your dev env is already in a container