Re: sandboxing agents, SyscallFilter=,: https://news.ycombinator.com/item?id=47171887