is this a good bubblewrap script to isolate web development tools? I don't want to get fucked up by running random npm commands. Already tried containers the upkeep was quite a lot of work.
bwrap \
--ro-bind /usr /usr \
--ro-bind /bin /bin \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /sbin /sbin \
--ro-bind /etc /etc \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--clearenv \
--die-with-parent \
--unshare-pid \
--unshare-uts \
--unshare-ipc \
--unshare-cgroup \
--bind $HOMEDIR ~ \
--ro-bind ~/.config/nvim ~/.config/nvim \
--ro-bind ~/.config/fish_sandbox ~/.config/fish \
--ro-bind ~/.local/share/nvim ~/.local/share/nvim \
--ro-bind ~/.vim ~/.vim \
--setenv HOME "$HOME" \
--setenv PATH "$PATH" \
--setenv LANG "$LANG" \
--tmpfs "$XDG_RUNTIME_DIR" \
--ro-bind "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" \
--setenv XDG_RUNTIME_DIR "$XDG_RUNTIME_DIR" \
--setenv WAYLAND_DISPLAY "$WAYLAND_DISPLAY" \
--setenv DISPLAY "$DISPLAY" \
--ro-bind /tmp/.X11-unix /tmp/.X11-unix \
--chdir ~ /usr/bin/fish