This is still less safe and less convenient than sandboxing. I want them to be able to run whatever command they want inside the sandbox even if it's traditionally dangerous (overwrites files, etc) because it can't touch anything that matters and I can revert any changes to the code myself.

If anything the only thing you'd have to have reviewed is sandbox escape attempts.