Ideally you would sandbox this with: 1. No filesystem access 2. No network access 3. Input passed on stdin (or a pre-opened fd) 4. Output passed to stdout (

Ideally you would sandbox this with: 1. No filesystem access 2. No network access 3. Input passed on stdin (or a pre-opened fd) 4. Output passed to stdout (or a pre-opened fd) 5. A hard timeout specified before the process is killed Suddenly bam, dramatically safer. If you're looking for a tool that can do all of this for you, check out firejail: https://firejail.wordpress.com/ https://firejail.wordpress.com/ It has a ton of options, but you can do all of what I suggested and more, really easily.