[iamcreasy]

Interesting read. Is docker sandbox a solution in this situation?

[zwu-var]

Not always. The safest way is to use a throwaway remote VM when dealing with untrusted content. Sandbox escaping is unlikely but still a risk on your laptop.