what if there was a USB adapter that had a little chip in it that routed anything that passed through it directly to and from the sandboxed environment?

you could configure it with bash commands.