Firejail runs apps in a sandbox.

And you can make a separate non-root desktop profile to run it in so even if it somehow escapes containment it can't run sudo commands or steal your main login's data.