Only one pidns in a sandbox

I found that in sentry, there is only when pidns(root) in a sandbox(containerType = ContainerdContainerTypeSandbox).
It means that all the containers in a sandbox has the same pid namespace.
Is this by design?
```
663 func (k *Kernel) CreateProcess(args CreateProcessArgs) (*ThreadGroup, ThreadID, error) {
664 k.extMu.Lock()
665 defer k.extMu.Unlock()
666 log.Infof("EXEC: %v", args.Argv)
667
668 if k.mounts == nil {
669 return nil, 0, fmt.Errorf("no kernel MountNamespace")
670 }
671
// Here pass the k.tasks.Root namespace. by Zhang Ning
672 tg := k.newThreadGroup(k.tasks.Root, NewSignalHandlers(), linux.SIGCHLD, args.Limits, k. monotonicClock)
673 ctx := args.NewContext(k)
674
675 // Grab the root directory.
676 root := args.Root
677 if root == nil {
678 root = fs.RootFromContext(ctx)
679 // Is the root STILL nil?
680 if root == nil {
681 return nil, 0, fmt.Errorf("CreateProcessArgs.Root was not provided, and failed to get root from context")
682 }
683 }
```