Only accept in-bound requests. Don't provided it with any special credentials. Someone might still be able to get an RCE on them and burn a bit of money, but t

Only accept in-bound requests. Don't provided it with any special credentials. Someone might still be able to get an RCE on them and burn a bit of money, but they certainly wouldn't be able to move laterally.