Would strict containerization help here? (rootless, read-only partial fs access, only the necessary env variables passed, etc)