Hardening the Unpacakgeable: A systemd-run Sandbox for Third-Party Binaries

A technical deep-dive into sandboxing untrusted npm and Python binaries using systemd-run and Linux namespaces.