And Linux would like to present you bubblewrap [1][2][3][4] or the infamous SELinux.

[1]: https://github.com/containers/bubblewrap#usage

[2]: https://man.archlinux.org/man/bwrap.1

[3]: https://wiki.archlinux.org/title/Bubblewrap#Usage_examples

[4]: https://wiki.archlinux.org/title/Bubblewrap/Examples#p7zip

That has the caveat that it only works as far as apps opt into it