If it's not safe then it wouldn't be a proper sandbox I'm the first place. The goal is to intercept all system calls and reimplement them in a lightweight kerne

If it's not safe then it wouldn't be a proper sandbox I'm the first place. The goal is to intercept all system calls and reimplement them in a lightweight kernel that talks with the host kernel only via a minimal 9p based protocol. I.e. there is never a direct syscall being served by the host kernel on behalf of a process running inside the container. From what I can read in their design docs, the user id running inside the container seems completely irrelevant.