a nice set up to have the best of both worlds: security and usability

for example in this use case:
Especially the interactive shell is security-critical, but also a nice shell is fun

Use as a login shell mksh and for interactive usage fish-shell (or zsh) in a sandbox like this:

#!/bin/sh
(exec bwrap \
  --proc /proc \
  --dev /dev \
  --dev-bind /dev /dev \
  --ro-bind /usr /usr \
  --ro-bind /bin /bin \
  --ro-bind /etc /etc \
  --ro-bind /lib /lib \
  --ro-bind /var/lib/pacman /var/lib/pacman \
  --bind "$HOME" "$HOME" \
  --bind /tmp /tmp \
  --bind /media /media \
  --unshare-cgroup \
  --unshare-ipc \
  --unshare-uts \
  /usr/bin/fish "$@")

#  --unshare-pid \

this leads to a strictly restricted home-only interactive shell with no suid / use an external mksh for sudo/doas stuff

(remember: all client launched from that shell will have the same restrictions, which is intended)

obviously this can be improved