even more reasons to sandbox it to a container or vm