docker's sandboxes are cli only atm