The experimental Sandboxed Mode sounds interesting, there should be a dedicated fork focused on sandbox mode replicating QubesOS with containers rather than VMs.