> Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? Not really. The compiler has to be able to access large sw

> Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? Not really. The compiler has to be able to access large swaths of your code. You want to e.g. keep your code safe. You would have to have very finely-grained sandboxing to prevent substantive disclosure, and even then you're likely leaking information.