Another way to sandbox it if I don't trust the chrome-sandbox to set it setuid as root?