docker gets you pretty close if you don't open up network access