The ideal setup is something like the safe interpreters in Tcl, which let you do very fun things like having config files in pure Tcl, but with limited access to the machine and master interpreter.