points
I have a half-assed bwrap-based solution of my own, but flar seems much more thorough, and I like that it's a single binary with sensible defaults.