Are you aware of https://firejail.wordpress.com/ ? Sounds like it's what you are looking for (or is there a reason it does not satisfy your requirements?)
Thank you - I was not aware of firejail.
It appears that this does the things I am looking for - however, I am suspicious - why do we need a new project like this rather than a simple recipe for the existing jail or chroot system calls ?
What is it that makes something like firejail necessary ?
I've run it only once, and I don't really know, but I was under the impression it just took care of setting up bpf syscall filters and namespaces to provide least privilege - which, given neither X not e.g. Firefox was designed to be sandbox, is more complicated than one would expect.
I would like to run 3-4 browsers at all times, each with totally sandboxed identity and IP address.
However I do not necessarily want to run a full blown VM for each of them.
This is very simple and efficient for sandboxing server daemons - I do it all the time and there is almost zero overhead involved in chroot/jail. However I have never chrooted a GUI application and cannot find any instances/recipes of anyone chrooting a browser ...