A platform supports a sandboxed container runtime for higher-isolation workloads. How should an application select the configured runtime handler?

1. Set a Service annotation named sandboxed=true
2. Rename the image tag to sandboxed
3. Use a ConfigMap instead of a Secret for application configuration
4. Reference the corresponding RuntimeClass through runtimeClassName