Sandboxing a Linux process usually means spending a lot of effort deciding what it isn’t allowed to see. Instead of carefully hiding most of the filesystem, why not just take the filesystem away? Absolute paths fail. Relative paths using the normal current-directory mechanism fail. But for controlling filesystem access, FailFS has a nice, simple philosophy.