In reply to @dcuthbert

Untrusted workloads now run inside a layered, fail-closed sandbox that combines Linux namespaces, Landlock, seccomp-BPF, filesystem isolation, controlled network egress, environment sanitisation, and resource limits.