Bits of sandboxing mainly from Morph
Debugging call to containerised_cmdline
Set PREFIX to /usr
Let's try one sandbox for the whole assembly