a simple sandbox using namespaces and seccomp