Comment by news_hacker

the "best practice" suggestion would be to do this in a sandboxed container