proot-next
chroot, bind mounts and a bubblewrap front end without any privilege. Path syscalls are answered through seccomp user notification by a small supervisor; only exec and a handful of others take a ptrace stop. Built for desktop applications and Steam inside containers.
Overview
What proot-next is, what it replaces, and how it differs from PRoot.
Quickstart
Download a static binary and run a rootfs or a proot-apps application.
bwrap mode
Stand in for bubblewrap under Steam's pressure-vessel without user namespaces.
Container images
How proot-apps and the selkies baseimages ship and wire the binary.