Is open_basedir enough?
More than only regex
Cursor manipulation to hide terminal output
Process privacy for multi tenant environments
