Take a look at Nvidia OpenShell, and their dev blogs on it. That seems like what you're looking for.
Sounds OpenShell locks filesystem access on sandbox creation - arguably the most important isolation feature, at least for my use cases. Architecturally it looks right though!
alt Hacker News
Sounds OpenShell locks filesystem access on sandbox creation - arguably the most important isolation feature, at least for my use cases. Architecturally it looks right though!