This project is using Docker to run sandboxed builds: https://www.reddit.com/r/rust/comments/dti647/announcing_cargowharf_docker_image_builder_for/ Apparently the sandboxing backends are also pluggable.