Agreed; the silicon can run a container/real sandbox, Apple just won't ship it. Until they do, we're all stuck just SSHing into our Macs as a workaround.