# Get the sandbox
wget -c "https://github.com/probonopd/bubblewrap/releases/download/binary/bwrap"
# Get the AppImage to be run inside the sandbox
wget -c "https://bintray.com/probono/AppImages/download_file?file_path=Leafpad-0.8.17-x86_64.AppImage" -O Leafpad-0.8.17-x86_64.AppImage
# FUSE-mounting does not seem to work inside the sandbox
sudo mount Leafpad-0.8.17-x86_64.AppImage /mnt -o loop
chmod a+x ./bwrap
mkdir -p $HOME/leafpad/
mkdir -p $HOME/.config/leafpad/
./bwrap --ro-bind / / --dev /dev --bind $HOME/.config/leafpad/ $HOME/.config/leafpad/ --bind $HOME/leafpad/ $HOME/leafpad/ /mnt/AppRun
sudo umount /mnt
https://github.com/projectatomic/bubblewrap
To run an AppImage in a read-only sandbox so that it can only write to
$HOME/.config/leafpad/and$HOME/leafpad/:Works for me :-)