Insular and Shelter. Apparent Shelter is more secure but I don’t know enough to tell myself. https://secure-system.gitlab.io/Insular/faq.html

this doesn’t matter but I found it interesting bc of all the people recommending tools like shelter and insular, using profiles or work profiles to separate data would be siloing not sandboxing.

edit: with that said, as others have pointed out, apps are already sandboxed on Android. they can only really communicate with mutual consent ipc. so say for example, Google services can communicate with other Google apps because they both explicitly call for each other. while ipc is still technically something to think about, the mutual consent requirement makes it somewhat difficult to make malicious use of it.

apps aren’t capable at accessing other app data whenever they wish, though. even with storage permissions granted it only really has access to user directories (downloads, documents, etc.).

edit2: additionally, it’s worth noting that using any profiles (work or normal), will increase ram and battery usage by a decent margin as this will make a second user with all system apps running alongside your main user.

any solution involving root should also be considered a non-option as well, since gaining root access completely cripples androids security model.

Work profile with Shelter? Run GraoheneOS?

I use Shelter from F-Droid to create a work profile and then install RethinkDNS on that profile which blocks any trackers from the “bad” apps (you can add a tonne of blocklists). Additionally, if you have a Pixel, GrapheneOS has total app isolation (including storage scopes) so Messenger only has access to what you allow.

I am by no means an expert and I’m def interested in what others have to say on this issue as well.

I use Greenify and it allows you to quarantine apps and run them on an emulated version of Android. So there’s one option

Android apps are already sandboxed. You don’t need to sandbox them further unless you’re giving them permissions to peek out of that sandbox.

Edit: Also would like to add x8 sandbox to the list. It emulates its own android instead of using profile management features like the other apps mentioned. Since it’s proprietary I wouldn’t trust it (and it does have a performance impact), but wanted to throw it out here.

I offer android container https://github.com/twoyi/twoyi

If you are on Samsung devices, there is ‘Secure folder’ which basically is ‘Work’ profile.