Ive been using btrfs snapshots and some auto generated isolation rules plus a git ceiling at the mount root for the btrfs image (have to do this in wsl, stupid work computer). it's worked really well and fable hasn't had any issues with the "sandbox" (obviously not really but it works well enough)