Use seccomp to help isolate execution on untrusted input

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information