a simple sandbox using namespaces, cgroups and seccomp