> Those other processes with the tightest sandbox possible...

I guess I should get really around to getting the nvidia-vaapi-driver to work inside the decode sandbox, rather than requiring it to be disabled.