What do you mean by 'completely sandboxed'? and why is setting this up painful?