the “reqs” thing (where pex downloads dependencies for you) is never going to work in bazel with sandboxing enabled, unfortunately