[yaodub]

Interesting middle ground between full WASM lockdown and a bare environment. Did you end up needing to block anything else beyond the package manager?