Comment by dbmikus

I agree in using a separate OS-level sandbox or a VM. Better to have the option for modularity.

However, for ease of use, it is nice for harnesses to by default run with sane and safe sandboxing setup. Then give the option to disable them.