If so, I would look into applying a decent seccomp profile. Other hardening solutions could be to run the workloads inside of a VM such as Firecracker, or gVis

If so, I would look into applying a decent seccomp profile. Other hardening solutions could be to run the workloads inside of a VM such as Firecracker, or gVisor. But that might be more work to implement compared to seccomp.