req jail run HTTP REQUEST CONTROLLER & RUNNER STAGED FILES PRE-SCRIPT CHROOT + FS JAIL PRIV DROP + NONEWPRIVS SECCOMP ALLOWLIST USER CODE EXECUTION