Problem

Known problem - build-scripts are allowed to do absolutely anything - network, io, write fs outside of OUT_DIR, etc..

Proposed Solution

We just need custom runner setting such as existing target..runner but for build-scripts.
That way everyone on any platform can specify their own parameters for their sandbox. e.g. for macOs something like : sandbox-exec -p “(version 1)(allow default)(deny network*)” denies network access.

This is good, I suppose, because:

1. Universal solution that can be used in various ways on any host,
2. Independent from inner in-toolchain implementation, see next point,
3. Depends only on outer things by user or users System, which is great. It can be user’s script, tool, or preconfigured sandbox or environment.
4. Simpl impl - runner already there.