“intercepting sycalls and notifying an exterior sandbox host” –Codius