Suppose you have a proto compiler like:
go_proto_compiler(
name = "go_opaque",
options = [
"myargs=somehting",
],
plugin = "//my/cool:plugin",
visibility = ["//visibility:public"],
deps = PROTO_RUNTIME_DEPS + WELL_KNOWN_TYPES_APIV2,
)
And the plugin uses runfiles, then those runfiles are not included in the sandbox.