There are yet thousands of these so-called "sandbox" projects that exists. This one sounds rather really wasteful on resources?
Bubblewrap would just be a better alternative for this.
bubblewrap is linux only and offers a fraction of isolation of a microvm
right chain of tought, but
systemd is the only to truly leverage linux namespaces capabilities, allowing private networks, other rootfs, etc
loading story #50398153
bwrap has a lot of sharp edges that can bite you, if you're not aware of them.