It's actually annoying NixOS doesn't offer good default sandboxing. Sandboxing should appeal to the Nix crowd, but somehow it's not been integrated yet. AFAIK, GuixSD is working on sandboxing.
In general, sandboxing is pretty important and an area were Linux distributions are falling behind macOS and mobile.
In general, sandboxing is pretty important and an area were Linux distributions are falling behind macOS and mobile.