Implement sandboxing and single-process mode