Running it in a chroot or a scoped down namespace is all your need most of the time anyways.