The process of sandboxing in layer two calls for restricting certain sys calls that write to the Ethereum blockchain and replacing them with calls into the hypervisor. This enables the addition of restricted calls, making bytecode functioning possible in Ethereum's Layer Two.