the container build is nesssary to have a coherent build. It is quite similar to a docker app, but it just doesn’t need the docker service and it builds and runs without any root access (you could build this as a guest on a linux-host and, if you have access to bwrap, even run it). Also the app is then transfereble to any other linux-system. It is astonishing simple and convenient. You can use the build-system to build cli-container-apps of your choice. unix-style[*] programming for all the different linux-systems out there is extremly difficult, because the systemes are very uncoherent, so this build-kit fixes this and also allows users to build a working app for a friend and send it per mail. (the resulting transfer-size can be as small as <5Mb [depending on your system])

Also, yes it increases the security quite a bit: only rw in the home folder of the container, just sharing network with the OS, … and more benefits like tmpfs for all nonpermanent files (zero disk-io for those)

Also yes, it could be part of (a users) story: a described above, this can be build and transferred on servers with limited user rights (allthough bwrap is needed), but in can be indeed used to jailbreak from such a server and connect with the ITP-network. The ITP-network allows information-exchange via relay nodes, so it could used to get the right hints, even if tor is not available, but access to static-ip4/6-nodes (which should be always the case)

[*] but unix-style programming was absolutely needed for this project, because it is REAL retro-style. 90% of the tec used is from the 70’s - it’s a real Retro-party :D

edit: typos, more info