AppImages can be started as binary executables (set exec permission for that).

To run them in the firejail sandbox as when tey want root permission do firejail --noprofile ./<name>.AppImage

the option --noprofile deselect the default profile

--net=none would turn net off

~/.config/firejail/<name>.profile can creates a profile

./<name>.AppImage --appimage-extract creates a squashfs-root folder that holds the files from the AppImage.

./squashfs-root/AppRun will then run it