The idea is to have a mini-system in the chroot tree and call an effective chroot /path/to/sandbox /bin/script where script actually is in /path/to/sandbox/bin. You will need to set that up, however you call it, suid root, and need to release root privilege before any user code is evaled. A small C program may be the simplest to set up. Any system utils you permit will need to be copied into that tree in their customary locations. They should be static builds unless you want copies of all the needed system dll's.

Not even root can break out of a properly set up sandbox. The perl installation is needed the same as any other executable. If it's not in the sandbox it effectively doesn't exist for the jailed process.

If you lack privilege to secure this, you probably shouldn't be doing it.