the "best practice" suggestion would be to do this in a sandboxed container