You can have sandboxes that are not capability-based. It refers to a specific style of modeling the problem. (EDIT: and e.g. the Rust crate referenced doesn't actually sandbox the process, but uses design and kernel APIs to make it harder to mistakenly access the wrong files - still a capability system)