Bubblewrap-based application sandbox with resource isolation
