[mistrial9]

on linux make a non-root, limited shell login to start? avoid Windows

[c45y]

You can do a lot with seccomp filters that would stop even root messing things up too badly, down to path level io filtering unless I misremember