The sandboxing logic should probably be available as shared library so that not only executed apps can be locked into a sandbox but also software such as a web browser, PDF or image viewer can lock their rendering/javascript components into sandboxes.App ImagesApplications shall be shipped in single-file app images.