For folks interested in the current state of the art on sandboxing, here is a stab one of my former coworkers did: https://github.com/firedancer-io/firedancer/

For folks interested in the current state of the art on sandboxing, here is a stab one of my former coworkers did: https://github.com/firedancer-io/firedancer/blob/main/src/util/sandbox/fd_sandbox.c https://github.com/firedancer-io/firedancer/blob/main/src/ut... He researched chromeos process virtualization, moby (docker upstream), and chrome tab isolation. It’s all done ebpf magic on top of seccomp at its core.