I think https://gvisor.dev/ might be the closest thing I can think of to container level sandboxing that tries to add meaningful security guarantees.