And if it needs to install packages, have a 5 line Go proxy that talks to Artifactory and exposes only what is needed as a surface.