Run programs on Linux with selectively restricted permissions

 Subuser turns a docker container into a normal program, but this program
 is not fully privileged, it can only access the directory
 from which it was called.