It was fun to read, but it would’ve probably been easier to rely on seccomp filters instead.