A coworker of mine has a pretty neat script that uses bubblewrap to wrap any application. I'm using that one too for pi and it's pretty great since you don't have to trust the harness and can quite easily customize the sandbox to your needs, e.g. disallow reading to certain directories etc.

This blogpost describes a similar thing: https://bxt.rs/blog/easy-sandboxing-on-linux-with-bubblewrap...