I'd argue that you should simply sandbox it. If performance is an issue, throw it in a VM or container with a simple socat + fork + TCP-LISTEN on a socket and pipe data in/out over TCP.