Anyone out there use bubblewrap to sandbox mediainfo/ffmpeg/imagemagick (for content identification and thumbnail generation)?

It looks like they only use ~30 common syscalls between them and a very restricted seccomp-bpf filter, no ipc/network access, and minimal fs access (ro bins/libs, hopefully next-to-no dev/proc/sys) should be doable.

#Projects #ImgBox