Docker Sandboxes are just that. The default file access is just the directory you create the sandbox under. They lock down most network access also, with whitelisting of domains and a firewall.