Sandboxing should be handled externally by something like Flatpak