diff --git a/lib/tooling/base-tool.ts b/lib/tooling/base-tool.ts
index 91c73b36f..7d2bf8ff7 100755
--- a/lib/tooling/base-tool.ts
+++ b/lib/tooling/base-tool.ts
@@ -35,8 +35,8 @@ import {ToolInfo, ToolResult} from '../../types/tool.interfaces.js';
 import * as exec from '../exec.js';
 import {logger} from '../logger.js';
 import {OptionsHandlerLibrary} from '../options-handler.js';
+import {propsFor} from '../properties.js';
 import {parseOutput} from '../utils.js';
-
 import {ITool, ToolEnv} from './base-tool.interface.js';
 
 const toolCounter = new PromClient.Counter({
@@ -51,6 +51,7 @@ export class BaseTool implements ITool {
     protected addOptionsToToolArgs = true;
     public readonly id: string;
     public readonly type: string;
+    public readonly sandboxType: string;
 
     constructor(toolInfo: ToolInfo, env: ToolEnv) {
         this.tool = toolInfo;
@@ -58,6 +59,9 @@ export class BaseTool implements ITool {
         this.addOptionsToToolArgs = true;
         this.id = toolInfo.id;
         this.type = toolInfo.type || 'independent';
+
+        const execProps = propsFor('execution');
+        this.sandboxType = execProps('sandboxType', 'none');
     }
 
     getUniqueFilePrefix() {
@@ -125,10 +129,23 @@ export class BaseTool implements ITool {
         return _.find(foundLib.versions, (o, versionId) => versionId === selectedLib.version);
     }
 
-    // mostly copy&paste from base-compiler.js
+    protected replacePathsIfNeededForSandbox(args: string[], physicalPath: string): string[] {
+        if (this.sandboxType !== 'nsjail' || !physicalPath) return args;
+
+        return args.map(arg => {
+            if (arg && arg.length > 1) {
+                return arg.replace(physicalPath, '/app');
+            } else {
+                return '';
+            }
+        });
+    }
+
+    // mostly copy&paste from base-compiler.js, but has diverged a lot :(
     getIncludeArguments(
         libraries: SelectedLibraryVersion[],
         supportedLibraries: Record<string, OptionsHandlerLibrary>,
+        dirPath?: string,
     ): string[] {
         const includeFlag = '-I';
 
@@ -136,6 +153,11 @@ export class BaseTool implements ITool {
             const foundVersion = this.findLibVersion(selectedLib, supportedLibraries);
             if (!foundVersion) return [];
 
+            if (foundVersion.packagedheaders && dirPath) {
+                const includePath = path.join(dirPath, selectedLib.id, 'include');
+                return [includeFlag + includePath];
+            }
+
             return foundVersion.path.map(path => includeFlag + path);
         });
     }
diff --git a/lib/tooling/bronto-refactor-tool.ts b/lib/tooling/bronto-refactor-tool.ts
index 9d00d1fe7..6ae02808c 100644
--- a/lib/tooling/bronto-refactor-tool.ts
+++ b/lib/tooling/bronto-refactor-tool.ts
@@ -22,6 +22,7 @@
 // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 // POSSIBILITY OF SUCH DAMAGE.
 
+import path from 'node:path';
 import {splitArguments} from '../../shared/common-utils.js';
 import {CompilationInfo} from '../../types/compilation/compilation.interfaces.js';
 import {ToolInfo} from '../../types/tool.interfaces.js';
@@ -50,7 +51,9 @@ export class BrontoRefactorTool extends BaseTool {
     ) {
         const sourcefile = inputFilepath;
         const options = compilationInfo.options;
-        const includeflags = super.getIncludeArguments(compilationInfo.libraries, supportedLibraries || {});
+        const pathDir = inputFilepath ? path.dirname(inputFilepath) : undefined;
+
+        const includeflags = super.getIncludeArguments(compilationInfo.libraries, supportedLibraries || {}, pathDir);
         const libOptions = super.getLibraryOptions(compilationInfo.libraries, supportedLibraries || {});
 
         let compileFlags = ['compiler-explorer']
diff --git a/lib/tooling/clang-tidy-tool.ts b/lib/tooling/clang-tidy-tool.ts
index 904c3c081..106bb797a 100644
--- a/lib/tooling/clang-tidy-tool.ts
+++ b/lib/tooling/clang-tidy-tool.ts
@@ -54,7 +54,7 @@ export class ClangTidyTool extends BaseTool {
         const sourcefile = inputFilepath;
         const options = compilationInfo.options;
         const dir = path.dirname(sourcefile);
-        const includeflags = super.getIncludeArguments(compilationInfo.libraries, supportedLibraries || {});
+        const includeflags = super.getIncludeArguments(compilationInfo.libraries, supportedLibraries || {}, dir);
         const libOptions = super.getLibraryOptions(compilationInfo.libraries, supportedLibraries || {});
 
         let source = '';
@@ -81,6 +81,8 @@ export class ClangTidyTool extends BaseTool {
         compileFlags = compileFlags.concat(manualCompileFlags);
         compileFlags = compileFlags.concat(this.tool.options);
 
+        compileFlags = this.replacePathsIfNeededForSandbox(compileFlags, dir);
+
         // TODO: do we want compile_flags.txt rather than prefixing everything with -extra-arg=
         await fs.writeFile(path.join(dir, 'compile_flags.txt'), compileFlags.join('\n'));
         const result = await super.runTool(compilationInfo, sourcefile, args);
diff --git a/lib/tooling/compiler-dropin-tool.ts b/lib/tooling/compiler-dropin-tool.ts
index bf26d0069..3d0cad17e 100644
--- a/lib/tooling/compiler-dropin-tool.ts
+++ b/lib/tooling/compiler-dropin-tool.ts
@@ -22,6 +22,7 @@
 // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 // POSSIBILITY OF SUCH DAMAGE.
 
+import path from 'node:path';
 import {splitArguments} from '../../shared/common-utils.js';
 import {CompilationInfo} from '../../types/compilation/compilation.interfaces.js';
 import {ToolInfo, ToolResult} from '../../types/tool.interfaces.js';
@@ -111,8 +112,9 @@ export class CompilerDropinTool extends BaseTool {
         supportedLibraries?: Record<string, OptionsHandlerLibrary>,
     ): Promise<ToolResult> {
         const sourcefile = inputFilepath;
+        const pathDir = inputFilepath ? path.dirname(inputFilepath) : undefined;
 
-        const includeflags = this.getIncludeArguments(compilationInfo.libraries, supportedLibraries || {});
+        const includeflags = this.getIncludeArguments(compilationInfo.libraries, supportedLibraries || {}, pathDir);
         const libOptions = this.getLibraryOptions(compilationInfo.libraries, supportedLibraries || {});
 
         const compileFlags = this.getOrderedArguments(compilationInfo, includeflags, libOptions, args, sourcefile);
diff --git a/lib/tooling/microsoft-analysis-tool.ts b/lib/tooling/microsoft-analysis-tool.ts
index e98bcafd3..f3961cfaf 100644
--- a/lib/tooling/microsoft-analysis-tool.ts
+++ b/lib/tooling/microsoft-analysis-tool.ts
@@ -86,7 +86,11 @@ export class MicrosoftAnalysisTool extends BaseTool {
         const sourcefile = inputFilepath;
         const options = compilationInfo.options;
         const libOptions = super.getLibraryOptions(compilationInfo.libraries, unwrap(supportedLibraries));
-        const includeflags = super.getIncludeArguments(compilationInfo.libraries, unwrap(supportedLibraries));
+        const includeflags = super.getIncludeArguments(
+            compilationInfo.libraries,
+            unwrap(supportedLibraries),
+            inputFilepath ? path.dirname(inputFilepath) : undefined,
+        );
 
         let compileFlags = splitArguments(compilationInfo.compiler.options);
         compileFlags = compileFlags.concat(includeflags, libOptions);
diff --git a/lib/tooling/pvs-studio-tool.ts b/lib/tooling/pvs-studio-tool.ts
index 46af74ec8..93fa26e10 100644
--- a/lib/tooling/pvs-studio-tool.ts
+++ b/lib/tooling/pvs-studio-tool.ts
@@ -62,7 +62,7 @@ export class PvsStudioTool extends BaseTool {
         // Collecting the flags of compilation
         let compileFlags = splitArguments(compilationInfo.compiler.options);
 
-        const includeflags = super.getIncludeArguments(compilationInfo.libraries, compilationInfo.compiler);
+        const includeflags = super.getIncludeArguments(compilationInfo.libraries, compilationInfo.compiler, sourceDir);
         compileFlags = compileFlags.concat(includeflags);
 
         const libOptions = super.getLibraryOptions(compilationInfo.libraries, compilationInfo.compiler);
diff --git a/lib/tooling/sonar-tool.ts b/lib/tooling/sonar-tool.ts
index 80c39fa30..c5aad6a7a 100644
--- a/lib/tooling/sonar-tool.ts
+++ b/lib/tooling/sonar-tool.ts
@@ -189,7 +189,11 @@ export class SonarTool extends BaseTool {
         // Collecting the flags of compilation
 
         let compileFlags: string[] = splitArguments(compilationInfo.compiler.options);
-        const includeflags = super.getIncludeArguments(compilationInfo.libraries, supportedLibraries || {});
+        const includeflags = super.getIncludeArguments(
+            compilationInfo.libraries,
+            supportedLibraries || {},
+            inputFilePath ? path.dirname(inputFilePath) : undefined,
+        );
         compileFlags = compileFlags.concat(includeflags);
         const libOptions = super.getLibraryOptions(compilationInfo.libraries, supportedLibraries || {});
         compileFlags = compileFlags.concat(libOptions);
diff --git a/test/options-handler.ts b/test/options-handler.ts
index d2f12a42f..6ad7385e2 100644
--- a/test/options-handler.ts
+++ b/test/options-handler.ts
@@ -528,6 +528,7 @@ describe('Options handler', () => {
                     id: 'faketool',
                     type: 'independent',
                     addOptionsToToolArgs: true,
+                    sandboxType: 'none',
                     tool: {
                         args: undefined,
                         compilerLanguage: 'fake',
@@ -549,6 +550,7 @@ describe('Options handler', () => {
                     id: 'someothertool',
                     type: 'independent',
                     addOptionsToToolArgs: true,
+                    sandboxType: 'none',
                     tool: {
                         args: undefined,
                         compilerLanguage: 'fake',