Give a bubblewrap (bwrap) sandbox a writable overlay filesystem so an untrusted process can write to what looks like a full directory tree without touching host files, using --overlay, --tmp-overlay, or --ro-overlay.

Documented steps

1. Ephemeral, discardable overlay whose writes vanish on exit: `bwrap --overlay-src /usr --tmp-overlay /usr --proc /proc --dev /dev bash`. Per bwrap.xml, with `--tmp-overlay`, 'all writes will go to the tmpfs that hosts the sandbox root... Writes will therefore not be persisted across multiple runs.'
2. Persistent overlay backed by a real writable directory and workdir: `mkdir -p /var/lib/myapp/upper /var/lib/myapp/work && bwrap --overlay-src /usr --overlay /var/lib/myapp/upper /var/lib/myapp/work /usr --proc /proc --dev /dev COMMAND`. bwrap.xml: WORKDIR 'must be an empty directory on the same filesystem as RWSRC'.
3. Read-only union of two or more sources: `bwrap --overlay-src /opt/base --overlay-src /opt/patch --ro-overlay /usr --proc /proc --dev /dev COMMAND` — `--ro-overlay` 'requires at least two --overlay-src to precede it' (bwrap.xml).
4. Order matters when stacking multiple `--overlay-src`: 'the first source on the command line at the bottom of the stack,' and a path present in more than one source is read from the last source specified (bwrap.xml) — list lowest-priority sources first.
5. Check kernel support before relying on this: `--ro-overlay`, or using more than one `--overlay-src`, 'requires a Linux kernel version of 4.0 or later' per bwrap.xml.