To be fair you need to go to the hypervisor level (like Firecracker) to get any decent level of sandboxing.