[anirudhrx]

Thanks for the question. Anirudh here. Firstly, there isn't always a need to isolate everything by default - in some cases, the testing being done may / application layer entities may already provide the isolation necessary.

However, there are cases like needing to test a schema change for example which can't be done at the application layer. For those cases, there's a DAG-based resource plugin (https://www.signadot.com/docs/resource-plugin-overview) framework that we built, that acts like a lifecycle hook associated with each sandbox - running containers when the sandbox is created & destroyed.

What the platform teams do to provide isolation is to write plugins that set up isolation for the sandbox as needed. The isolation is often logical tenants (as opposed to being at the infrastructure level) like a new schema / table / etc, and includes some of the data seeding / restoring a snapshot type of operations. We have some examples already of different plugins and are writing more.