Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /.