Looks like there is a glaring omission: on Linux, the best way to sandbox program is via systemd service file, which is only a few lines of ini file, no matter

Looks like there is a glaring omission: on Linux, the best way to sandbox program is via systemd service file, which is only a few lines of ini file, no matter what your source code is written as. This is especially bad for the second part - if you are comparing existing open-source sandbox solution, you should not ignore the most common method on Linux!