[BlimpSpike]

Similarly to the bubblewrap comment, I'd also like to know how it compares to nsjail.

I think nsjail uses mount namespaces (CLONE_NEWNS) instead of landlock for filesystem sandboxing, but what would the practical differences be?