@jan For me personally most of my understanding of sandboxes derive from what Chromium team has ever done starting from https://lwn.net/Articles/332974/. This was before seccomp filters :-) Chromium is a great source of information for this topic.