Fun article! A modern way to do this on Linux (specifically) is to use PID-namespaces for isolation. You can pass CLONE_NEWPID to the flags argument of clone(

Fun article! A modern way to do this on Linux (specifically) is to use PID-namespaces for isolation. You can pass CLONE_NEWPID to the flags argument of clone(2) so that the new process is PID 1 in a new PID-namespace. One of the special properties of PID 1 is that when it dies all of other processes in the PID-namespace will receive SIGKILL. So, create a new "shim" process in a new PID-namespace and have that process fork&exec the rogue program (it's probably better to fork&exec than just exec because of the special properties of PID 1 that the rogue programming you're running may not be built to handle.) If you want to kill the rogue program, just kill your shim. You need to be root (have CAP_SYS_ADMIN) to create a new PID-namespace. If you're not (or more likely don't want to be) you can first create a new user-namespace with the CLONE_NEWUSER flag. You'll be root in that user namespace and can create a new PID-namespace. You'll probably also want to launch the rogue program as a non-root user though, so make sure to figure that out. Docker does this sort of stuff. man pages: * http://man7.org/linux/man-pages/man7/pid_namespaces.7.html http://man7.org/linux/man-pages/man7/pid_namespaces.7.html * http://man7.org/linux/man-pages/man7/user_namespaces.7.html http://man7.org/linux/man-pages/man7/user_namespaces.7.html * http://man7.org/linux/man-pages/man7/namespaces.7.html http://man7.org/linux/man-pages/man7/namespaces.7.html * http://man7.org/linux/man-pages/man2/clone.2.html http://man7.org/linux/man-pages/man2/clone.2.html