* Drop privileges and run as `nobody:nobody`. * Chroot into `/var/www/htdocs`. * Compile with hardening options.
Add static build option to Makefile and create Dockerfile to run it.