Add an bubblewrap entrypoint option

[DrRuhe]

bubblewrap is a tool to wrap a process in a sandbox. This would allow the following:

• avoiding the PID1 problem(i.e. the kernel handles PID1 process signals differently, leading to unintuitive behavior)
• easy mapping of options like env vars and volumes

It obviously has the downside of incurring a small overhead, but every solution to setup an environment for a process has this overhead so I guess its best to use the easiest option available.