This is sort of a tangent question but is relevant to Nashorn and server side JavaScript execution. Is there a standard practice for sandboxing server side Java

This is sort of a tangent question but is relevant to Nashorn and server side JavaScript execution. Is there a standard practice for sandboxing server side JavaScript execution? I'm asking because my product has what I call "Smart Attributes" which are basically programmable context aware metadata. These "Smart Attributes" are designed to be attached to a Git commit, GitHub pull request, diff lines, etc. and can be programmed in JavaScript to react to what it is attached to. In the beginning I gave the user the ability to execute their Smart Attribute scripts on the server side but I eventually removed that option because I didn't have the time to fully think it through. Basically I was paranoid about missing something that would allow them to do dangerous things on the server. This was a couple of years ago and I was using Rhino from Mozilla. Now that Nashorn is available, I've been thinking about JavaScript server side execution again, and was wondering if there were any best practice sandboxing methods and/or libraries. If anybody knows of any good documentation or libraries for sandboxing in Nashorn, I would love to hear about it.