[paxy]

If you don't need a GUI then you can use Docker for basic sandboxing. It isn't a foolproof solution, but it's about as close as you are going to get without full virtualization.

[akvadrako]

You can put GUI apps in docker too. You just need to give access to X or the wayland socket.

[nebulous1]

This does mean the app can make x calls though. So it could run a keylogger, for instance