Sandboxes in Kubernetes without privileged: cgroup_writable and hostUsers: false

A pod that builds sandboxes — one that runs other people's code in its own namespaces, with a cgroup...