[mike-cardwell]

Same way you isolate any program on Linux. SELinux, AppArmor, or running as a dedicated user.

[edit] I suppose there are containers nowadays too.

[pmlnr]

containers still need apparmor/selinux to be secure; a container is just a packaging method without those.