Good question with a lot of possible answers. You can take sandboxing as far as you want, really. I typically just use bubblewrap (linux)