bwrap is so much better without Flatpak.

To start you off: $ bwrap --dev-bind / / --tmpfs ~ bash

This basically gives you a shell in a clean virtual home directory (but no meaningful security improvement yet). You can test new builds of software as if you have only the default settings. If you need to access files, move them to /tmp/.

To see the clean virtual home directory, replace --tmpfs ~ with --bind "$(mktemp -d)" ~. You can browse it where mktemp puts it (usually /tmp/*).

To start to lock down security, replace the --dev-bind with --ro-bind, and add various --new-session, --uid/--gid, and --unshare-all/--unshare-* flags. You can run untrusted and semi-trusted/less-trusted applications with less security risk this way (as long as you’re aware of pitfalls, such as the /tmp/.X11-unix/X0 socket and other possible avenues of escape).

To block network access, use --unshare-net or --unshare-all. To virtualize /dev and /proc, use --dev /dev and --proc /proc.

Some programs might need --dev-bind /dev/dri /dev/dri for graphics driver access, or similar constructs.