Real Sandboxing

[jfhbrook]

Master has docker support, but docker containers aren't designed for sandboxing.

The core abstraction can probably be used alongside https://github.com/projectatomic/bubblewrap or similar--I think the idea is you convince docker to dump your container's contents into that directory and then you're off to the races. I think.