I know the fine tool firejail, which allows to sandbox programs, so they cannot access
/media and so on.
What it cannot do is to replace system data in the sandbox. This means when I sandbox a program, it can for example read
/etc/passwd and see which user accounts are in there.
Is there a sandbox solution, which allows to hide this and e.g. replace
/etc completely with a fake directory with default files from a fresh installation or similiar?
The best solution after firejail seems to be an LXC container. But this would mean installing one container per program with all the required libraries (which could be quite a lot especially for X11 programs) and accessing X11, audio, and some other things isn't that easy as well. Furthermore all containers need to have separate updates.
Another solution may be docker and forking one base VM several times, but this suffers from not having common updates as well.
Is there another software for easy lightweight jails, which can hide as much from the system as possible?