stuff that talks to "the internet" and runs as "root" seems like a good thing to build with filc.
It probably uses OS sandboxing primitives already.
It probably uses OS sandboxing primitives already.