Sandbox ships

[FireSquid6]

In the config of each ship when doing a fleet launch should be a sandbox: option that uses bwrap to sandbox. It allows the following options:

• memory - memory limit
• cpu - cpu limit
• env vars - env vars
• read-only-bind - list of directories to bind as read only
• read-write-bind - list of directories to bind as write only

By default the data dir of the ship is read-write and all of the essential files you would need to do normal computer stuff are bound as read only.

It is very crucial to ensure that the fagent command is made available to the sandbox but the fleet command is not (don't want rogue agents configuring fleet).