For folks interested in the current state of the art on sandboxing, here is a stab one of my former coworkers did:
https://github.com/firedancer-io/firedancer/blob/main/src/ut...
He researched chromeos process virtualization, moby (docker upstream), and chrome tab isolation. It’s all done ebpf magic on top of seccomp at its core.