I would like to run a program in such a way that, for just that invocation of that program:

1. The file system appears as read only, as if the partition(s) had been mounted read-only. There would be two exceptions:

1a. The current directory and any sub-directories would be writable.

1b. /tmp and any sub-directories would be writable

2. No net is visible, accessible nor usable.

This would usually be run as root. This would usually be for running something from the command line.

What would be a good way to do this?

Thank you.

Got it. Firejail is a solution, yay.

So, to run bash in the way that I wanted:
Order may matter: I have the read-write bits occur *after* specifying the entire file system read-only.

Firejail seems to like absolute paths, so that is why I used `pwd` instead of . for the current directory. This may not be necessary?

Thanks for the update and solution.