I started putting together a plan on how we might be able to implement machine isolation in cockpit building off the somewhat stalled sandbox work that Stef started.
https://github.com/cockpit-project/cockpit/wiki/Machine-isolation
I'd appreciate any comments or suggestions anyone might have.