Replace bubblewrap with unshare + chroot

[kernc]

Reimplementation based on unshare from util-linux package. Drops bwrap as a dependency.

[keturn]

I just stumbled across sandbox-run and it looks quite useful!

Of course, running random scripts off GitHub can be as much a problem as running scary-binary itself, so I was happy to find the source is short and straightforward use of bwrap.

The implementation in this PR makes for a different first impression.

It's still very good for shell code, backed by rigorous application of shellcheck and a test suite. I just can't help but ask: what did bubblewrap do wrong that made you decide you'd rather maintain hundreds of lines of shell script?

[kernc]

@keturn Hey! Thanks for the kind words. Indeed, the recent proliferation of installation steps comprising curl ... | bash has led me to figuring this out. Bubblewrap works and I'm happy with it so far.

Then somebody hinted at unshare. I figured I would only need a few more lines to achieve filesystem isolation, and I'd be all set! Well, this is what came out. 😅 It's now hefty 500-ish lines (~100 lines went for seccomp syscalls enumeration), but consider these are mere 500 lines of POSIX Linux Shell that replicate now nearly the whole of Bubblewrap (and, with support for its config profiles*, Firejail as well). That is with no extra dependencies (util-linux and mount are preassumed) and without a build step or the associated machinery. 🤷

Considering the two versions functionally equivalent (a huge assumption as I'm a real kernel noob), I now like this one somewhat better. But you too are right, as the length and ordering of the commit log in this PR confirms, shell certainly is full of biting gremlins.

I thought of putting the old version in a branch/tag, but your unexpected comment raises legitimate questions whether the two versions can be maintained side by side ...

The implementation in this PR makes for a different first impression.

Would appreciate a more thorough review! 😝

---

* New additional features in this PR:

• support for Firejail profiles,
• non-shared network namespace,
• seccomp filtering active by default.