Open basedir config, separate /tmp, insecure function blacklisting... tons of stuff, php-fpm is the starting point - yes. It takes much more manual work to set

Open basedir config, separate /tmp, insecure function blacklisting... tons of stuff, php-fpm is the starting point - yes. It takes much more manual work to set everything correctly than running a python application.