Real Sandboxing

Master has docker support, but docker containers aren't designed for sandboxing.

The core abstraction can probably be used alongside https://github.com/projectatomic/bubblewrap or similar--I think the idea is you convince docker to dump your container's contents into that directory and then you're off to the races. I think.

Start by examining the existing Docker support and the core abstraction mentioned in the issue. Compare how that abstraction could work with bubblewrap or a similar sandboxing tool, then define the isolation behavior and integration needed for the work to be complete.

Written by the indexing model from the issue text.