After that I run them in containers, no network access, ro filesystem.