Currently cros-disks binds whole /dev into FUSE sandbox. While every sandbox needs /dev/fuse, not every needs access to other nodes like block devices. Probably binding should be more targeted.