[dmitrygr]

> --best-effort: Use best effort mode, falling back to less restrictive sandbox if necessary [default: enabled]

Enabled by default: this strikes me as a particularly poor design choice