[Request]: What exactly does "Sandbox per bottle" do?

[c2630o59v]

Tell us the problem or your need

There is no good documentation that I could find about what "Sandbox per bottle" does.

Describe the solution you'd like

I think there should be some documentation about this. I personally would like to know the answer to the following:

1. Does it prevent read/write access to other bottles and other resources inside the flatpak?
2. Does it prevent memory access to other running bottles?
3. Does it fix any x11 vulnurabilities such as hijacking a super user terminal window?

Other solutions?

No response

Additional context and references

No response

[Sturmlocke86]

I'm in the same boat as I am trying to decide whether to turn this on or off for enhanced isolation etc. How does it work, what are the pros and cons? Have you been able to find more infos on the subject? @c2630o59v

Edit, found this a few minutes ago: #1158 and #1691