sandbox: basic CPU and memory limits