a discussion from a little while ago where many of the comments discuss sandboxing strategies: https://news.ycombinator.com/item?id=49239751