chenv-bwrap

#!/usr/bin/env bash

set -ueo pipefail

show_help() {
	cat <<EOF
Usage: $0 <new-home-dir> <command> [args...]

Run a command with filesystem isolation - nothing writes to real \$HOME.
EOF
}

if (( $# < 2 )); then
	show_help
	exit 1
fi

if [[ ! -d "$1" ]]; then
	echo "$1 does not exist!"
	exit 2
fi

readonly NEW_HOME="$(cd "$1" && pwd)"
readonly RUNTIME_DIR="${XDG_RUNTIME_DIR:-"/run/user/$(id -u)"}"
shift

exec bwrap \
	--ro-bind / / \
	--dev-bind /dev /dev \
	--proc /proc \
	--tmpfs /tmp \
	--bind "$NEW_HOME" "$HOME" \
	--bind-try "$RUNTIME_DIR" "$RUNTIME_DIR" \
	--ro-bind-try /tmp/.X11-unix /tmp/.X11-unix \
	--ro-bind-try "$HOME/.Xauthority" "$HOME/.Xauthority" \
	--setenv PATH "${HOME}/bin:${HOME}/local/bin:$PATH" \
	"$@"