libvirt application sandbox framework