Consider gvisor

[NilsIrl]

If a dockerc-generated executable is made available by someone else than the author of the docker image using gvisor could guarantee that using the image is safe: https://github.com/google/gvisor