Make the sandbox a bit tighter.

    Put it in a pid namespace.