Making sure a command is never run as root.

sudont whoami # anyone but "root"

sudont runs the given command in a minimal runc-like container with a substituted user namespace to drop root privileges.