The reason I’m asking is that separate wineprefixes will look like a “different wine instance” to a layman, but they’re not the same thing as a sandbox. Wine mounts the host filesystem under the Z: drive, and even beyond that there are probably ways to escape the Wine environment. For true sandboxing some additional layers will be required.

Is Bottles actually containerized in any meaningful way? Last I checked it just managed wineprefixes, and Wine is not a sandbox.

Yeah. “Feature parity or get out”, like dude we’re long past feature parity.

Wayland supports so much more stuff than X11 does, and what does X11 have that Wayland doesn’t? X forwarding? Just use a modern remote desktop solution, all X forwarding was doing in “modern” times (read: the 21st century) was streaming pixels anyway, just less efficiently than modern remote desktop.