[alpn]

> say, "can't touch the filesystem or network"

Well, OpenBSD has pledge(2) and unveil(2), both of which are very easy to use.

https://man.openbsd.org/pledge.2 https://man.openbsd.org/unveil.2