A command-line sandboxing tool. Uses Seatbelt on macOS, Bubblewrap on GNU/Linux.