I know, I maintain quite a few items in NixPkgs. My point is that Linux distributions are not taking sandboxing seriously compared to mobile or macOS, and this

I know, I maintain quite a few items in NixPkgs. My point is that Linux distributions are not taking sandboxing seriously compared to mobile or macOS, and this is a big security issue. E.g., if one runs a compromised binary, such as PyTorch [1], sandboxing as implemented by Firejail or bwrap provides defense in depth. You might be running a compromised binary, but it won't be able to read your entire $HOME and steal your data. I think NixOS is in a great position to offer seamless integration of one sandboxing framework, thanks to the declarative nature of package derivations. But it'd probably need to support just one framework, as it's a pretty foundational component, just like you can't easily switch from systemd to something else. [1] https://pytorch.org/blog/compromised-nightly-dependency/ https://pytorch.org/blog/compromised-nightly-dependency/