Oh wow. I'd be very interested in hearing how they sandbox rust-analyzer. I found a discussion of supporting the analyzer itself by generating config files [1][2], but not how you can sandbox it.
That would be extremely useful as the analyzer is a pretty juicy target and also runs proc-macros/build.rs scripts.
Correct, it's more a defense in depth technique, not a complete defense.
> On all developer machines as well? No. Very few big orgs do this and only for mission-critical stuff.
All builds at Google for instance use the model I laid out including 'developer builds'.