Translations:Manual:$wgShellRestrictionMethod/6/en

Use firejail (https://firejail.wordpress.com/), a Linux sandboxing system.