That's what opam (ocaml package manager) uses for linux sandboxing