[LtWorf]

It takes time to pick one lock and twice as much to pick two.

It takes the same time to escape 1 or 10000000 sandboxes.

[gf000]

That's only somewhat true if we are talking about the same sandbox nested (which would be quite dumb to do).

Escaping two different sandboxes are multiple times as hard, and a sane sandbox is not trivially picked, see web browsers and that the fact that the world is not one giant botnet.

[LtWorf]

How many implementations of linux namespaces are there in the kernel? Is it more than one?

[gf000]

Is a wasm sandbox, or the browser not a sandbox, independent of the kernel?

[LtWorf]

Has one of them ever gone more than a month without a CVE?