[reegnz]

You can add that via an extension: https://github.com/carderne/pi-sandbox

The price of flexibility is, pi is not opinionated about adding sandboxing out-of-the-box, it gives you options on how you want to do it. You either do it with linux containers, with a dedicated VM, or just bubblewrap. It is nice that it gives you a way to hook into it in a very easy way though.