>Yet, their tools such as codex are able to read ALL FILES on my PC

Why not just use your OS-integrated permission mechanism? No container needed.