Comment by kernc

I wrote myself a handy and generalized bwrap-wrapping script: https://github.com/sandbox-utils/sandbox-run