You can choose what parts of the standard library scripts allowed to use. Just exclude os/debug libraries, and that's it. Newer versions of the Programming in Lua book contain detailed instructions.

Lua is extremely sandboxable from hosting C. Just only add modules, functions and features you want added. Makes good use of the C preprocessor flags too. But also check out QuickJS as a neat alternative. But it probably doesn’t compare in speed to LuaJIT which is mostly the flavor used I think.

Lua supports sandboxing via its _G variable, i.e., implicit global scope. When you call a script, you can pass it a custom _G.