@utterfiction@joshbressers on plan 9, programs like web servers do bind the to-sandbox directory to / within the program. Then the relative paths are the absolute paths automatically, and .. can't break out of the sandbox path. It's actually quite easy to do that if you don't need access to files outside the sandbox directory (you can still find a way around that within your program, but that depends on the program flow)