In my personal experience, is that you need to sandbox everything and that could potentially make the dev experience cumbersome. For example, you might need to

In my personal experience, is that you need to sandbox everything and that could potentially make the dev experience cumbersome. For example, you might need to bring into the sandbox an external tool that signs your binaries and depending on the build system and your needed add-on this can be a pain in the neck. Luckily, there are some good tools out there like bazel [1] (the open source version of what we use internally at Google) that can help you get this right. [1] https://bazel.build/ https://bazel.build/