[didroe]

>The actual killer feature being their ability to reduce attack surface substantially by simply having fewer syscalls that can be abused

Can you not use Seccomp for that?