I'm not too excited about embedding the data (rootfs) within the image. Have a .preinit_array section that runs a seccomp-bpf filter, unshare, etc with filter,

I'm not too excited about embedding the data (rootfs) within the image. Have a .preinit_array section that runs a seccomp-bpf filter, unshare, etc with filter, unshare, etc data in their own sections (this allows zeroing a section to get original behaviour)