I find the sandboxing to be very subpar. It works for the most basic use-cases but for anything with slightly more complicated requirements you're better off scripting your way through cgroups and namespaces.