code: @VisibleForTesting
    boolean isSandboxEnforced(List<Path> services) throws AppEngineException {
      boolean relaxSandbox = false;
      boolean enforceSandbox = false;
      for (Path serviceDirectory : services) {
        Path appengineWebXml = serviceDirectory.resolve("WEB-INF/appengine-web.xml");
        try (InputStream is = Files.newInputStream(appengineWebXml)) {
          if (AppEngineDescriptor.parse(is).isSandboxEnforced()) {
            enforceSandbox = true;
          } else {
            relaxSandbox = true;
          }
        } catch (IOException | SAXException ex) {
          throw new AppEngineException(ex);
        }
      }
      if (relaxSandbox && enforceSandbox) {
        log.warning("Mixed runtimes detected, will not enforce sandbox restrictions.");
      }
      return !relaxSandbox;
    }
docs: This method determines if the dev app server should run with sandbox restrictions based on the
  runtime parsed from appengine-web.xml on all services. If one service can run with no sandbox
  restrictions, all other services will also run locally with no restrictions.
  
  @param services a list of app engine standard service directories
  @return {@code false} if there no need to enforce the sandbox restrictions.