LESSSECURE=1 versus OS isolation when paging untrusted files: trading shell-escape removal for access convenience

When paging untrusted files with color and search enabled, a practitioner must choose between LESSSECURE=1 and OS-level isolation to prevent shell escapes. LESSSECURE=1 disables the interactive commands !, |, :e, v, s, and = within less itself, but its coverage is version-dependent and does not inherently suppress LESSOPEN/LESSCLOSE preprocessors, which may still execute with the invoking user's privileges. OS isolation—running less as an unprivileged user, inside a container, or against a read-only mount—provides stronger boundary enforcement but removes conveniences such as :e and v, and requires the file to be readable by the isolation account. The unresolved decision hinges on whether the threat model prioritizes prevention of in-pager shell escapes or broader process isolation, especially when preprocessor chains and distribution-specific feature sets vary.

Which approach preserves search and color functionality without introducing shell-escape risk? How does feature coverage evolve across less point releases? Can LESSSECURE=1 interact with LESSOPEN to still invoke preprocessors, and can OS isolation be configured to retain :e and v while blocking other escapes?