A useful tool I created a few years ago but never really promoted much: usand

https://github.com/richfelker/usand

It creates no-network (cutting off main exfil vectors), read-only except for current dir and descendants, sandboxed environment to run low-trust code, even full build processes, within.

Only dependency is unshare(1) utility and Linux kernel with unprivileged namespace functionality.