fix(sandbox): support Podman escape hatches (#1106)