Yeah that's what I mentioned in the last sentence of my comment The reason most build systems don't have it is because sandboxing is OS-specific Bazel has sor

Yeah that's what I mentioned in the last sentence of my comment The reason most build systems don't have it is because sandboxing is OS-specific Bazel has sort of a complicated bootstrap/deployment for that reason. I mentioned it a few times, but someone should extract the exec wrappers from Bazel as a separate project :) It's a small amount of code, though fiddly to build and distribute There are few other strategies like bubblewrap, but last I heard bubblewrap is not installed by default on most distros. It needs setuid root so it's a bit fiddly and has security implications But then you also need something totally different for OS X and Windows