My mistake, You are right. I had read the question as foolproof sandbox that included eval. One can see the banning the syscalls approach as cutting the Gordia

My mistake, You are right. I had read the question as foolproof sandbox that included eval. One can see the banning the syscalls approach as cutting the Gordian knot.