a convenient truth

This utility, isolate, runs processes in a chroot-ed environment, with constrained resource limits, as a random UID, and with limited access to the X server. An isolated program ("isolatee") no longer has all the authority of your user account, but you can still enjoy its legitimate functionality. You can play even maliciously-crafted songs in an unsafely implemented music player, with greatly minimized risk to your other data.