An even simpler "sandbox" is to create a separate user and home dir for your LLM.