Run it in a container. Don't let the container run as root - create an account which has the same ID as a dummy account on your host system. If you have to volume mount, be very explicit about what paths you mount and use the read only flag if it makes sense. If you can't mount read only because you need to write to certain files, then grant the container account access to those files using ACLs (eg: on Linux user 'chmod' or 'setfacl').