actually catch all syscalls
Add in libcodius-sandbox preload and intercept ptrace'd syscalls
link host against sandbox-rpc
Split out sandbox logic into a tiny class