Sandboxing in general is thought of as a policy thing that should be implemented in userspace. Kernel provides basic tools (namespaces, seccomp, whatever...), and userspace decides how to combine them to make a sandbox, whatever the developer wants that to be.