Use bubblewrap for sandboxing instead of firejail

[madaidan]

Firejail has way too large attack surface that has led to many privilege escalations and sandbox escapes in the past.

It would be better if orjail used bubblewrap instead which is similar to firejail but has minimal attack surface.

I can create a pull request that implements most of the same functionality as firejail but using bubblewrap instead if this is something you're interested in. The only things I don't know how to replicate with bubblewrap are the --dns=, --name= and --netns= options.

[phantomcraft]

You should pass "ip netns exec brwrap <...>" to make bubblewrap use the network namespace.

As for "--dns=", you should create a folder at /etc/netns with the same name of network namespace and put a resolv.conf file inside it.