Libcapsicum, userns in Linux (although that isn't really sand boxing in the sense of libcapsicum). If you want 100% sanboxing without any form of exploitability

Libcapsicum, userns in Linux (although that isn't really sand boxing in the sense of libcapsicum). If you want 100% sanboxing without any form of exploitability you're either looking at a capability based operating system (probably with managed code) or use layers up on layers up on.. With KVM and such