Thanks for the input, I agree and I've added a warning to the readme taking this into account and directing readers to this discussion.

I do think there is value in ease of use with something like sandy. I'm unlikely to setup gvisor just to run some arbitrary script I found online. I assume most people today just will run scripts directly on their machine. With sandy, I was experimenting if you could get 80% of the security while still making it really easy to use. I agree that it still hasn't met that mark with regards to security but I think it's possible to improve that.