We install hermetic jdk and python distributions inside the repo. For OSX we have to additionally scrub the java.extensions since it reaches into /System for jnilib etc.