What about running it as a flatpak? Do you think that’s restricted enough if it is exposed to the internet?