You can lock a Linux C process inside a security sandbox so strict that even if an attacker gets Remote Code Execution, they cannot open a file, spawn a shell, or touch the network.
One call to prctl with SECCOMP_MODE_STRICT tells the kernel: if this process attempts any syscall other than read, write, or _exit, kill it immediately with SIGKILL.