Guix uses the sandboxing logic iirc