you can't really stop a desktop computer from running arbitrary software. If users can install compilers (which you pretty much have to allow), then all you can do is make them go through extra steps.