seems like the only way to a proper ‘hermetically sealed’ env and even then, still not