Check out the code for the geordi bot that hangs out in freenode##c++. It uses some of the more advanced linux sandboxing features I've seen