if you haven’t seen it already, https://www.pantsbuild.org/docs/rules-api-process#process explains the sandboxing a bit