you can drop the resulting binary in a scratch container that has no shell, etc.