Sandboxed execution environments

Docker's SBX kit writes a receipt for every eval command it runs

The open-source kit runs an evaluation command inside a Docker Sandbox and records six fields about what happened, which settles which command produced a number without settling what was installed at the time.