NEWS: cgroups, ipc-sandbox, and network-sandbox