Apparmor.d for confining basics, anything given network access by apparmor sandboxed with NixPak or similar?