=== sandboxing: (aka, stop using firejail's setuid) ===

ideally would be lightweight lxc containers only running Wayland, with
	no fallback to X11
	- there is a '--no-x11' flag for 'gnome-shell':
		- https://old.reddit.com/r/gnome/comments/xa18en/how_to_disable_xwayland_completely/
	- https://wiki.archlinux.org/title/LXD#Use_Wayland_and_Xorg_applications
	- https://discuss.linuxcontainers.org/t/overview-gui-inside-containers/8767
	- https://blog.simos.info/running-x11-software-in-lxd-containers/
	- for issues mounting the X socket:
		https://github.com/lxc/lxd/issues/6584#issuecomment-564367714

for seccomp filtering, maybe try bwrap, or flatpak
	lxc already uses seccomp filtering
		see: /usr/share/lxc/config/common.seccomp

evolution mail client:
- copy ~/.config/evolution, and ~/.local/share/evolution to new install