Hacker News Reader

> they configured sshd to prevent players from running binaries other than the game

You might be interested in how to limit users to nologin shell coupled with subsystem access:

None of the links here seem to be the one post that I found years ago, but this one in particular is pretty interesting.

I found this[1] one while looking around, the thread has some additional interesting remarks, including an LD_PRELOAD attack vector.