encapsulate provides its client process the same environment it's started in, except for some limitations:
encapsulate remounts the whole filesystem read-only, except for user-selectable regions which are mounted read-write. It also isolates the process from the system's process table, network interface, IPC, and shared memory tables.
