The documentation states (emphasis mine):

Run a command in a sandbox based on the build dir. [...] and the same permissions the final app will have (except filesystem permissions)

What exactly are the exceptions? Has every app that I've run through --run been executed outside of a sandbox? It's unclear to me what are the exceptions and I can't find this info anywhere.