Ignore user package-db if sandbox is found

Otherwise it's kinda problematic, especially if
user's package db has newer versions of packages