Exactly. A setuid `delort-container` utility would be a good start.