The Linux distribution of Prism actually runs in a flatpak by default, which provides pretty OK isolation.