You can run the AppImages you don't trust with the Firejail sandbox which has native support for AppImage.

https://firejail.wordpress.com/documentation-2/appimage-supp...

This is a nice workaround I guess.

I'd call it following the Unix philosophy instead of a workaround.

> Make each program do one thing well. To do a new job, build afresh rather than complicate old programs by adding new "features".

Both AppImage and Firejail do one thing and do it well, you can easily combine both and get what you want.

SELinux does the job better though if someone just configures it. AppImages should be confined automatically IMO.

Sounds like a perfect addition to a -- preferable, but sometimes too heavyweight -- repository-based solution like apt. Basically a more powerful binary tarball.